CVE-2017-9805 PoC — Apache Struts 代码问题漏洞

Source

https://github.com/luc10/struts-rce-cve-2017-9805

Associated Vulnerability

Title:Apache Struts 代码问题漏洞 (CVE-2017-9805)
Description:The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

Description

CVE 2017-9805

Readme

### Description

Apache Struts RCE tool for CVE 2017-9805

### Options

- `u`: the target url;
- `c`: the command that'll be executed on a vulnerable target;
- `f`: automatically checks for RCE using a list of targets (one target per line);
- `p`: specify the port for a local listener - used with `f` option - (default: 8080)

### Usage

```
go run main.go -u target -c command
```

```
go run main.go -f filename
```

```
go run main.go -f filename -p port
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!