CVE-2018-11776 PoC — Apache Struts 输入验证错误漏洞

Source

https://github.com/649/Apache-Struts-Shodan-Exploit

Associated Vulnerability

Title: Apache Struts 输入验证错误漏洞 (CVE-2018-11776)
Description:Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.

Description

This tool takes advantage of CVE-2018-11776 and Shodan to perform mass exploitation of verified and vulnerable Apache Struts servers.

Readme

# APACHE STRUTS SHODAN EXPLOIT POC

* Author: [@037](https://twitter.com/037)

Original code can be found [here](https://github.com/hook-s3c/CVE-2018-11776-Python-PoC).

This tool takes advantage of CVE-2018-11776 and Shodan to perform mass exploitation of verified and vulnerable Apache Struts servers.
Shodan search parameter has been left out to weed out any skids trying to use this tool for malicious reasons. This tool is created to be treated as a proof of concept for researchers not an attack tool.

It's important to also mention this tool verifies if the host is vulnerable before performing the exploit process. Making simulated attacks stealthy.

### Prerequisites

You're required to install Python 3.x

```
apt-get install python3
```

You are also required to have Shodan module installed

```
pip install shodan
```


### Using Shodan API

This tool requires you to own an upgraded Shodan API

You may obtain one for free in [Shodan](https://shodan.io/) if you sign up using a .edu email.

![alt text](https://raw.githubusercontent.com/649/Apache-Struts-Shodan-Exploit/master/1.png)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →