A critical security vulnerability, identified as CVE-2023-50164 (CVE: 9.8) was found in Apache Struts, allowing attackers to manipulate file upload parameters that can potentially lead to unauthorized path traversal and remote code execution (RCE).# CVE-2023-50164: Apache Struts path traversal to RCE vulnerability
A critical security vulnerability, identified as CVE-2023-50164 (CVE: 9.8) was found in Apache Struts, allowing attackers to manipulate file upload parameters that can potentially lead to unauthorized path traversal and remote code execution (RCE).
This exploit script is written for a CVE analysis on [vsociety]([https://www.vicarius.io/vsociety/](https://www.vicarius.io/vsociety/posts/apache-struts-rce-cve-2023-50164)).
## PoC
A simple dummy app is developed for demonstration purposes (see `struts-app` folder).
You can deploy it to Tomcat or any other servlet, or run it by `mvn jetty:run`. In this latter case you can reach the app on port `9999`. The exploit script works only in cases when the app is deployed to Tomcat since the exploitation path is to upload a WAR webshell. However, many other exploitation path can work in case of the same vulnerability based on the used technologies and other circumstances.
## Usage
Install PIP packages:
```bash
pip install requests requests_toolbelt
```
Then, run the exploit script with for example:
```bash
python exploit.py --url http://localhost:8080/upload-1.0.0/upload.action
```
Note that the exploit needs a full URL where the file upload functionality is implemented.
## Disclaimer
This exploit script has been created solely for the purposes of research and for the development of effective defensive techniques. It is not intended to be used for any malicious or unauthorized activities. The author and the owner of the script disclaim any responsibility or liability for any misuse or damage caused by this software. Users are urged to use this software responsibly and only in accordance with applicable laws and regulations. Use responsibly.
[4.0K] /data/pocs/de3747783befd15e3ee0b42638c33c10dc9c7de2
├── [4.0K] exploit
│ ├── [4.3K] exploit.py
│ ├── [ 528] webshell.jsp
│ └── [ 723] webshell.war
├── [1.8K] README.md
└── [4.0K] struts-app
├── [8.9K] mvnw
├── [5.7K] mvnw.cmd
├── [3.7K] pom.xml
└── [4.0K] src
└── [4.0K] main
├── [4.0K] java
│ └── [4.0K] org
│ └── [4.0K] vicarius
│ └── [4.0K] example
│ └── [1.8K] Upload.java
├── [4.0K] resources
│ └── [ 869] struts.xml
└── [4.0K] webapp
├── [ 190] index.html
└── [4.0K] WEB-INF
├── [ 579] error.jsp
├── [ 600] success.jsp
├── [ 570] upload.jsp
└── [ 780] web.xml
11 directories, 14 files