来源

关联漏洞

描述

Exploitable target to CVE-2017-5638

介绍

## Exploit Demo for CVE-2017-5638

Completely based on https://github.com/piesecurity/apache-struts2-CVE-2017-5638

A realistic scenario where a reference project for a framework is deployed on a container but with terrible consequences. To familiarise yourself look at the code and compile it. Also investigate the dockerfile - does anything specific rise to get our attention?

Shows how easily every day decisions and multiple vulnerabilities in chain can be leveraged.

### Usage:
Pre-requisites:
1. have a JDK installed,
1. have Docker installed, Docker Desktop for Mac or Win
1. ideally have Python installed (can be replaced by [Jython](https://www.jython.org/))

To prepare:
1. clone this repo
1. run `./mvnw clean package` in project root
1. run `docker build -t hackme \.`
1. run `docker run -d -p 9080:8080 hackme`
1. once container comes online - verify by running in browser http://localhost:9080

Notice: if you don't have Docker installed, you can run `./mvnw jetty:run`

To begin testing RCE - run the `exploit.py` file:
* run `python exploit.py http://localhost:9080/orders/3 "CMD"`
* If you don't have Python, use the [Jython Standalone](https://www.jython.org/downloads.html) and\
  run `java -jar jython*.jar exploit.py http://localhost:9080/orders/3 "CMD"`

Try with different CMDs like
* `pwd` - where are we?
* `whomai` - what user are we running this?
* `ls -la` - what's in my directory?
* `ls /` - what's my machine
* `ls /etc` - what else we can find?

## How to Fix!
Use the Nexus Lifecycle [Component Information Panel](https://help.sonatype.com/iqserver/reporting/application-composition-report/resolving-security-issues) to identify a non-vulnerable version of struts2-core. 
Update the POM to that version and rebuild. You can also rebuild the Docker image and run it to retry the attack.

Also, look in the Issues here to see [DepShield](https://www.sonatype.com/depshield) findings


## Original readme

https://github.com/apache/struts/tree/master/apps/rest-showcase

```
README.txt - Rest Showcase Webapp

Rest Showcase is a simple example of REST app build with the REST plugin.

For more on getting started with Struts, see 

* http://cwiki.apache.org/WW/home.html

I18N:
=====
Please note that this project was created with the assumption that it will be run
in an environment where the default locale is set to English. This means that
the default messages defined in package.properties are in English. If the default
locale for your server is different, then rename package.properties to package_en.properties
and create a new package.properties with proper values for your default locale.
```

文件快照

 [4.0K]  /data/pocs/50926c310d354eb42cce9a0fedd9c72d905d5547
├── [ 316]  Dockerfile
├── [2.1K]  exploit.py
├── [2.3K]  Jenkinsfile
├── [9.9K]  LICENSE.txt
├── [9.7K]  mvnw
├── [6.2K]  mvnw.cmd
├── [6.1K]  pom.xml
├── [2.6K]  README.md
└── [4.0K]  src
    ├── [4.0K]  main
    │   ├── [4.0K]  java
    │   │   └── [4.0K]  org
    │   │       └── [4.0K]  demo
    │   │           └── [4.0K]  rest
    │   │               └── [4.0K]  example
    │   │                   ├── [ 414]  IndexController.java
    │   │                   ├── [1.8K]  Order.java
    │   │                   ├── [2.6K]  OrdersController.java
    │   │                   └── [ 794]  OrdersService.java
    │   ├── [4.0K]  resources
    │   │   ├── [ 533]  log4j2.xml
    │   │   ├── [1.6K]  struts.xml
    │   │   └── [  73]  velocity.properties
    │   └── [4.0K]  webapp
    │       ├── [4.0K]  css
    │       │   ├── [  90]  app.css
    │       │   ├── [138K]  bootstrap.css
    │       │   ├── [372K]  bootstrap.css.map
    │       │   ├── [115K]  bootstrap.min.css
    │       │   ├── [ 22K]  bootstrap-theme.css
    │       │   ├── [ 42K]  bootstrap-theme.css.map
    │       │   └── [ 19K]  bootstrap-theme.min.css
    │       ├── [4.0K]  fonts
    │       │   ├── [ 20K]  glyphicons-halflings-regular.eot
    │       │   ├── [106K]  glyphicons-halflings-regular.svg
    │       │   ├── [ 44K]  glyphicons-halflings-regular.ttf
    │       │   ├── [ 23K]  glyphicons-halflings-regular.woff
    │       │   └── [ 18K]  glyphicons-halflings-regular.woff2
    │       └── [4.0K]  WEB-INF
    │           ├── [4.0K]  content
    │           │   ├── [1.7K]  orders-deleteConfirm.jsp
    │           │   ├── [2.9K]  orders-edit.jsp
    │           │   ├── [2.5K]  orders-editNew.jsp
    │           │   ├── [2.3K]  orders-index.jsp
    │           │   └── [1.8K]  orders-show.jsp
    │           └── [1.5K]  web.xml
    └── [4.0K]  test
        └── [4.0K]  java
            └── [4.0K]  it
                └── [4.0K]  org
                    └── [4.0K]  apache
                        └── [4.0K]  struts2
                            └── [4.0K]  rest
                                └── [4.0K]  example
                                    ├── [ 786]  GetOrdersTest.java
                                    ├── [1.1K]  ListOrdersTest.java
                                    ├── [ 310]  ParameterUtils.java
                                    └── [4.5K]  PostOrderTest.java

21 directories, 37 files

备注