CVE-2017-9791 PoC — Apache Struts 输入验证错误漏洞

Source

https://github.com/dragoneeg/Struts2-048

Associated Vulnerability

Title:Apache Struts 输入验证错误漏洞 (CVE-2017-9791)
Description:The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.

Description

CVE-2017-9791

Readme

# Struts2-048
CVE-2017-9791

Author: DragonEgg
```python
def Usage():
    print 'check:'
    print '    python file.py http://1.1.1.1/struts2-showcase/integration/saveGangster.action'
    print 'poc:'
    print '    python file.py http://1.1.1.1/struts2-showcase/integration/saveGangster.action command'
```

# Demo
![image](https://github.com/dragoneeg/Struts2-048/blob/master/demo.jpg)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!