CVE-2023-50164 PoC — Apache Struts: File upload component had a directory traversal vulnerability

Readme

# CVE-2023-50164: Apache Struts Vulnerable Application

A critical security vulnerability, identified as CVE-2023-50164 (CVE: 9.8) was found in Apache Struts, allowing attackers to manipulate file upload parameters that can potentially lead to unauthorized path traversal and remote code execution (RCE).

## Application
A simple testing application is developed for CVE analysis

### Running Using Docker File

First Build the application using docker build command:

```
docker build -t exploitable -f DOCKERFILE .
```

Then, Run the application using docker run command: 

```
docker run -p 8080:8080 exploitable
```
In this case you can reach the app on port `8080`

### Running using MVN Jetty 

You can deploy it to Tomcat or any other servlet, or run it by `mvn jetty:run`. In this case you can reach the app on port `9999`. The exploit script works only in cases when the app is deployed to Tomcat since the exploitation path is to upload a WAR webshell. However, many other exploitation path can work in case of the same vulnerability based on the used technologies and other circumstances. 


## How to run the Exploit

Install PIP packages:
```bash
pip install requests requests_toolbelt                                                    
```

Then, You can change the path as per your application URL and run the below command:

```bash
python exploit.py --url http://localhost:8080/upload.action
```

Its recommended to run the application and exploit on Windows host. The exploit may not work on *nix based system sometimes. 


## Note
This exploit script has been created for the purposes of research. It is not intended to be used for any malicious or unauthorized activities.

File Snapshot

Remarks