CVE-2012-0392 PoC — Apache Struts ‘CookieInterceptor’组件权限许可和访问控制问题漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-0392.yaml

Associated Vulnerability

Title:Apache Struts ‘CookieInterceptor’组件权限许可和访问控制问题漏洞 (CVE-2012-0392)
Description:The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.

Description

The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.

File Snapshot


 id: CVE-2012-0392

info:
  name: Apache Struts2 S2-008 RCE
  author: pikpikcu
  severity: medium
  d

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →