CVE-2013-1965 PoC — Apache Struts 代码注入漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2013/CVE-2013-1965.yaml

Associated Vulnerability

Title:Apache Struts 代码注入漏洞 (CVE-2013-1965)
Description:Apache Struts是美国阿帕奇（Apache）软件基金会的一个开源项目，是一套用于创建企业级Java Web应用的开源MVC框架，主要提供两个版本框架产品，Struts 1和Struts 2。 Apache Struts 2.0.0至2.3.14版本中存在代码注入漏洞，该漏洞源于程序没有充分处理用户提交的输入。攻击者可利用该漏洞以运行受影响应用程序用户的权限操控服务器端上下文对象，可完全控制应用程序和底层计算机。

Description

Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.

File Snapshot


 id: CVE-2013-1965

info:
  name: Apache Struts2 S2-012 RCE
  author: pikpikcu
  severity: critical
 

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!