Struts2 Remote Code Execution Vulnerability

Source: Internet
Author: User

Apache official struts2 product, recently issued a remote code execution vulnerability, number "S2-013", is currently 0 day, the official no repair solution appeared.

Official security bulletins provide numbers and brief introductions

“A vulnerability, present in the includeParams attribute of the URL and Anchor Tag, allows remote command execution”

However, I did not discuss the principle or release any patches.


In fact, this struts2 officially issued a total of two vulnerabilities, there is a called s2-012, but this vulnerability, to see the question, it should be my previous Xcon2012 attack java web has burst out, so this article only describes the other one.
Official development of struts2 is dumb. For example, this vulnerability should be released by the official team. Since it has been released, it should be patched, but the official team only published this article. For details, normal users do not open access.

From this section, we can summarize the following points:

1. unpatched Remote Code Execution Vulnerability 2. The includeParams parameter encountered a problem in URLTAG.

Based on these two points, anyone familiar with the struts2 operating mechanism and previous vulnerability principles can easily analyze the specific POC usage.

Vulnerability trigger:

The latest version of struts2 is vulnerable because no patch is officially released. You can download the latest example application of Apache Struts 2.3.14 GA.

After a simple test, we can see the desired results.

According to the official information, the problem lies in tag a. Therefore, write a jsp page with the following content:

<s:a includeParams="all">Click here.</s:a>

This is the tag of the struts2 tag library. The tag displays the current URL on the page. When includeParams is set to all, the specific parameter content is displayed.
The only mystery that needs to be solved is how to make the parameter content as an OGNL to indicate trial execution, but it is not a good guess. I will test the result at will.
Access url:

Http: // localhost: 8080/blank/error. jsp? Aaa =$ {common POC of struts2, you know}

You can directly play the calculator, and everyone has the POC code. I only need to cut a picture:

There was almost no analysis process, and the POC was obtained. Finally, in order to study the repair solution, we had to study the vulnerability principle.

Vulnerability principle:

The url tag in the Struts2 tag Library and the includeParams attribute of the tag indicate the meaning of the Request access parameter. Once the value is assigned to ALL, GET, or POST, the specific request parameters are displayed. According to the normal requirements, it is enough to set the urlEncode parameter. The problem is that struts has done a step more, and the parameter has been parsed by OGNL!


Package org. Apache. struts2.views. Uti. defaulturlhelper parsequerystring method of this class. Public Map <string, Object> parsequerystring (string querystring, Boolean forcevaluearray) {Map <string, Object> queryparams = new linkedhashmap <string, Object> (); If (querystring! = NULL) {... If (paramname! = NULL) {paramname = translateanddecode (paramname); string translatedparamvalue = translateanddecode (paramvalue );...... translateanddecode calls private string translatevariable (string input) {valuestack = servletactioncontext. getcontext (). getvaluestack (); Return textparseutil. translatevariables (input, valuestack );}

In the end, textparseutil. translatevariables directly calls ognl for parsing and execution.

Vulnerability repair:

Wait for the official team. I'm not in a hurry. Or when there are good people forwarding, please write down the scheme by the way.

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.