CVE-2016-4438 PoC — Apache Struts 输入验证错误漏洞

Source

https://github.com/jason3e7/CVE-2016-4438

Associated Vulnerability

Title:Apache Struts 输入验证错误漏洞 (CVE-2016-4438)
Description:Apache Struts是美国阿帕奇（Apache）软件基金会的一个开源项目，是一套用于创建企业级Java Web应用的开源MVC框架，主要提供两个版本框架产品，Struts 1和Struts 2。 Apache Struts 2.3.20版本至2.3.28.1版本的REST插件中存在输入验证错误漏洞。远程攻击者可借助恶意的表达式利用该漏洞在服务器端执行任意代码。

Readme

ref:
https://raw.githubusercontent.com/coffeehb/Some-PoC-oR-ExP/master/Struts2/S2-037_PoC.py
https://raw.githubusercontent.com/coffeehb/Some-PoC-oR-ExP/master/Struts2/S2-037_CmdToolExP.py

File Snapshot


 [4.0K]  /data/pocs/e0ff4c4e53fe5d643b898bc734934fa4f7543e60
├── [   0]  init
├── [ 188]  README.md
├── [3.2K]  S2-037_CmdToolExP.py
└── [1.2K]  S2-037_PoC.py

0 directories, 4 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!