CVE-2024-53677 PoC — Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks

Source

https://github.com/cloudwafs/s2-067-CVE-2024-53677

Associated Vulnerability

Title:Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks (CVE-2024-53677)
Description:File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe. You can find more details in https://cwiki.apache.org/confluence/display/WW/S2-067

Description

s2-067(CVE-2024-53677)

Readme

# s2-067-CVE-2024-53677
s2-067(CVE-2024-53677)
Summary
File upload logic is flawed, and allows an attacker to enable paths with traversals - similar problem as reported in S2-066
Who should read this

All Struts 2 developers and users

Impact of vulnerability

Remote Code Execution

Maximum security rating

Critical

Recommendation

Upgrade to Struts 6.4.0 or greater and use Action File Upload Interceptor

Affected Software

Struts 2.0.0 - Struts 2.3.37 (EOL), Struts 2.5.0 - Struts 2.5.33, Struts 6.0.0 - Struts 6.3.0.2

Reporters

Shinsaku Nomura

CVE Identifier

CVE-2024-53677

Problem
An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.

Note: application not using FileUploadInterceptor are safe.

Solution
Upgrade to Struts 6.4.0 or greater and migrate to the new file upload mechanism.

Backward compatibility
This change isn't backward compatible as you must rewrite your actions to start using the new Action File Upload mechanism and related interceptor. Keep using the old File Upload mechanism keeps you vulnerable to this attack.

Workaround

CVE-2024-53677 Detail
Received
This vulnerability has been received by the NVD and has not been analyzed.

Description
File upload logic is flawed vulnerability in Apache Struts. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0, which fixes the issue. You can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067

File Snapshot


 [4.0K]  /data/pocs/0e12d5bab842d02a90d153d2c987dfc27b48dcce
├── [1.6K]  README.md
└── [  73]  s2-067-poc.py

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!