CVE-2023-50164 PoC — Apache Struts: File upload component had a directory traversal vulnerability

Source

https://github.com/aaronm-sysdig/cve-2023-50164

Associated Vulnerability

Title:Apache Struts: File upload component had a directory traversal vulnerability (CVE-2023-50164)
Description:An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.

Readme

# Disclaimer
Notwithstanding anything that may be contained to the contrary in your agreement(s) with Sysdig, Sysdig provides no support, no updates, and no warranty or guarantee of any kind with respect to these script(s), including as to their functionality or their ability to work in your environment(s). Sysdig disclaims all liability and responsibility with respect to any use of these scripts.

# Introduction

Simple app to demonstrate that Sysdig can detect `CVE-2023-50164`

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →