CVE-2023-50164 PoC — Apache Struts: File upload component had a directory traversal vulnerability

Source

Associated Vulnerability

Readme

# CVE-2023-50164: Apache Struts Vulnerable Application

A critical security vulnerability, identified as CVE-2023-50164 (CVE: 9.8) was found in Apache Struts, allowing attackers to manipulate file upload parameters that can potentially lead to unauthorized path traversal and remote code execution (RCE).

## Application
A simple testing application is developed for CVE analysis

### Running Using Docker File

First Build the application using docker build command:

```
docker build -t exploitable -f DOCKERFILE .
```

Then, Run the application using docker run command: 

```
docker run -p 8080:8080 exploitable
```
In this case you can reach the app on port `8080`

### Running using MVN Jetty 

You can deploy it to Tomcat or any other servlet, or run it by `mvn jetty:run`. In this case you can reach the app on port `9999`. The exploit script works only in cases when the app is deployed to Tomcat since the exploitation path is to upload a WAR webshell. However, many other exploitation path can work in case of the same vulnerability based on the used technologies and other circumstances. 


## How to run the Exploit

Install PIP packages:
```bash
pip install requests requests_toolbelt                                                    
```

Then, You can change the path as per your application URL and run the below command:

```bash
python exploit.py --url http://localhost:8080/upload.action
```

Its recommended to run the application and exploit on Windows host. The exploit may not work on *nix based system sometimes. 


## Note
This exploit script has been created for the purposes of research. It is not intended to be used for any malicious or unauthorized activities.

File Snapshot

 [4.0K]  /data/pocs/a5ce935d71805a223efbe970684fe27b78c2fa38
├── [ 161]  DOCKERFILE
├── [4.0K]  exploit
│   ├── [4.3K]  exploit.py
│   ├── [ 528]  webshell.jsp
│   └── [ 723]  webshell.war
├── [1.7K]  README.md
└── [4.0K]  struts-app
    ├── [8.9K]  mvnw
    ├── [5.7K]  mvnw.cmd
    ├── [3.7K]  pom.xml
    └── [4.0K]  src
        └── [4.0K]  main
            ├── [4.0K]  java
            │   └── [4.0K]  org
            │       └── [4.0K]  vicarius
            │           └── [4.0K]  example
            │               └── [1.8K]  Upload.java
            ├── [4.0K]  resources
            │   └── [ 869]  struts.xml
            └── [4.0K]  webapp
                ├── [ 190]  index.html
                └── [4.0K]  WEB-INF
                    ├── [ 579]  error.jsp
                    ├── [ 600]  success.jsp
                    ├── [ 570]  upload.jsp
                    └── [ 780]  web.xml

11 directories, 15 files

Remarks