CVE-2021-31805 PoC — Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.

Source

https://github.com/Wrin9/CVE-2021-31805

Associated Vulnerability

Title: Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE. (CVE-2021-31805)
Description:The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.

Description

S2-062 (CVE-2021-31805) / S2-061 / S2-059 RCE

Readme

# CVE-2021-31805
## Remote code execution S2-062 (CVE-2021-31805) Due to Apache Struts2's incomplete fix for S2-061 (CVE-2020-17530), some tag attributes can still execute OGNL expressions, The vulnerability allows an attacker to construct malicious data to remotely execute arbitrary code.
### CVE_2021_31805_POC_EXP.py
#### POC
pocsuite -r CVE_2021_31805_POC_EXP.py -u url

![1649996853(1)](https://user-images.githubusercontent.com/54984589/163518507-b5732b18-a9f7-473b-93a8-712d08e1f7a6.png)

#### EXP
pocsuite -r CVE_2021_31805_POC_EXP.py -u url --attack --command "[command]"

![1650007730(1)](https://user-images.githubusercontent.com/54984589/163539455-ce3e948e-44f0-4879-946e-64687b49368f.png)


# 免责声明
## 此工具仅用于学习、研究和自查。不应将其用于非法目的。使用本工具产生的一切风险与我无关！
# Disclaimer
## This tool is for study, research, and self-examination only. It should not be used for illegal purposes. All risks arising from the use of this tool have nothing to do with me!

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →