CVE-2017-5638 PoC — Apache Struts 2 输入验证错误漏洞

Source

https://github.com/invisiblethreat/strutser

Associated Vulnerability

Title:Apache Struts 2 输入验证错误漏洞 (CVE-2017-5638)
Description:The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

Description

Check for Struts Vulnerability CVE-2017-5638

Readme

# `strutser`

This program checks for CVE-2017-5638.

## Usage

```shell
Usage of ./strutser:
Usage of ./strutser:
  -c, --concurrency int   Concurrent HTTP requests. (default 10)
  -f, --file string       File containing targets
  -p, --ports intSlice    Ports to check. (default [80])
  -t, --timeout int       Timeout on HTTP requests. (default 15)
  ```

### Tips

* For multiple ports, use the `--ports` argument multiple times.
* The input file should be formatted with one IP address or hostname per line.
* To enable debugging, use `DEBUG=true` before the command, or `export DEBUG=true` for longevity.

## Notes
* Certificate checking is explicitly disabled.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!