CVE-2024-53677 PoC — Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks

Source

https://github.com/dustblessnotdust/CVE-2024-53677-S2-067-thread

Associated Vulnerability

Title:Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks (CVE-2024-53677)
Description:File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe. You can find more details in https://cwiki.apache.org/confluence/display/WW/S2-067

Readme

# 免责声明
请勿利用文章内的相关技术从事非法测试，由于传播、利用此文所提供的信息或者工具而造成的任何直接或者间接的后果及损失，均由使用者本人负责，所产生的一切不良后果与文章作者无关。该文章仅供学习用途使用。
# CVE-2024-53677-S2-067-thread
验证poc，https://github.com/TAM-K592/CVE-2024-53677-S2-067/
Apache Struts 的以下版本受到影响：2.0.0 至 2.5.33，6.0.0 至 6.3.0.2

根据poc的最近几天的历史，目前网上的最终版本是base64混淆，是昨天中文出来的（2024.12.18中午）
![image](https://github.com/user-attachments/assets/8099de5c-90ac-4041-9274-f98b97592a69)

我在大佬的基础上进行了一些修改
- 变成了多线程
- 解释变成了中文
```
usage: CVE-2024-53677-S2-067-thread.py [-h] (-u URL | -f FILE) --upload_endpoint UPLOAD_ENDPOINT [--paths PATHS [PATHS ...]]
                                       [--filenames FILENAMES [FILENAMES ...]] [--payload PAYLOAD] [-s THREADS] [-o OUTPUT]

S2-067 Exploit - 多线程文件上传支持并从文件中读取URL

options:
  -h, --help            show this help message and exit
  -u URL, --url URL     目标基础URL（例如：http://example.com）
  -f FILE, --file FILE  包含目标基础URL的文件路径，每行一个URL
  --upload_endpoint UPLOAD_ENDPOINT
                        上传端点路径（例如：/uploads.action）
  --paths PATHS [PATHS ...]
                        路径遍历测试路径
  --filenames FILENAMES [FILENAMES ...]
                        自定义载荷文件名
  --payload PAYLOAD     自定义JSP载荷内容
  -s THREADS, --threads THREADS
                        使用的线程数量（默认: 5）
  -o OUTPUT, --output OUTPUT
                        输出成功URL的文件路径（默认：success.txt）
```

File Snapshot


 [4.0K]  /data/pocs/82f7db77c553ed96caa552a86a5bf6db8e7643f8
├── [6.3K]  CVE-2024-53677-S2-067-thread.py
└── [1.8K]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!