来源

关联漏洞

描述

S2-045 漏洞 POC-TOOLS   CVE-2017-5638

介绍

#CNVD-ID	CNVD-2017-02474
发布时间	2017-03-07
危害级别	高 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
影响产品	Apache struts >=2.3.5，<=2.3.31
Apache struts >=2.5，<=2.5.10
CVE ID	CVE-2017-5638 
漏洞描述	Apache Struts是一款用于创建企业级Java Web应用的开源框架。 
Apache Struts2存在S2-045远程代码执行漏洞。远程攻击者利用该漏洞可直接取得网站服务器控制权。

#漏洞类型	通用软硬件漏洞

#URL参考链接	https://cwiki.apache.org/confluence/display/WW/S2-045
漏洞解决方案	Apache Struts官方已在发布的新的版本中修复了该漏洞。建议使用Jakarta Multipart parser模块的用户升级到Apache Struts版本2.3.32或2.5.10.1： 
#https://cwiki.apache.org/confluence/display/WW/S2-045

#Summary
Possible Remote Code Execution when performing file upload based on Jakarta Multipart parser.
Who should read this
All Struts 2 developers and users
Impact of vulnerability
Possible RCE when performing file upload based on Jakarta Multipart parser
Maximum security rating
High
Recommendation
Upgrade to Struts 2.3.32 or Struts 2.5.10.1
Affected Software:Struts 2.3.5 - Struts 2.3.31, Struts 2.5 - Struts 2.5.10
Reporter
Nike Zheng  dot zheng at dbappsecurity dot com dot cn>
CVE Identifier  CVE-2017-5638
Problem
It is possible to perform a RCE attack with a malicious Content-Type value. If the Content-Type value isn't valid an exception is thrown which is then used to display an error message to a user.
Solution
If you are using Jakarta based file upload Multipart parser, upgrade to Apache Struts version 2.3.32 or 2.5.10.1. You can also switch to a different implementation of the Multipart parser.
Backward compatibility
No backward incompatibility issues are expected.
Workaround
Implement a Servlet filter which will validate Content-Type and throw away request with suspicious values not matching multipart/form-data.

文件快照

 [4.0K]  /data/pocs/ddfb230f9bef24cae83a5c75456f748fa1089af2
├── [345K]  K8_Struts2-045_EXP.exe
├── [4.0K]  python-s2-045
│   ├── [1.8K]  cmd.py
│   ├── [1.4K]  poc_test.py
│   ├── [   7]  start.bat
│   ├── [4.0K]  Windows远程下载神器
│   │   ├── [ 362]  download.vbs
│   │   └── [ 125]  一条cmd远程下载.txt
│   └── [ 709]  专用JSP木马连接器.html
├── [1.9K]  README.md
├── [4.0K]  S2-045 Scan-批量扫描检测
│   ├── [ 51K]  HttpCodeLib.dll
│   └── [ 19K]  S2-045 Scan.exe
└── [4.0K]  s2-045批量检测程序win版
    ├── [2.0K]  AvailableURL.txt
    ├── [ 825]  keyword.txt
    └── [8.0M]  s2-045.exe

4 directories, 13 files

备注