-
Notifications
You must be signed in to change notification settings - Fork 13.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
CVE-2017-5638 - Apache Struts2 S2-045 #8064
Comments
Could this be turned into an exploit? ( |
|
My client's site was hacked yesterday. redacted |
Seems to be more an OGNL issue than a Multipart parser issue |
I've try on my own server but it's doesn't works (An error 500 is displayed). |
@busterb it was a stacktrace cut before showing any customer-related information, just to help you out and show that the problem exists in real life. But you needed to play smart ass at my expense I guess. |
@xtianus there was an internal hostname in there, or at least it looked like one to me. I wasn't trying to be a smart ass, apologies if that's how it sounded. |
There was none. You could have edited the hostname-lookalike instead of removing the whole thing, but that wouldn't have attracted 12 smiles I guess. |
The sad news is that this PR was prepared before we even had a chance to inform users about the new versions and it contains PoC reported to us which means we cannot even trust reporters :( |
My mistake @xtianus. I removed comment above. Here is the backtrace resurrected for reference:
|
@oli-h Based on my understanding the problem is that Jakarta Multiparser generates an exception when parsing the Content-Type. While raising this exception it tries to include the invalid data in the error message. Instead of displaying the invalid data it parses and executes the OGNL. So, as I understand it, the problem is the Jarkarta Multiparser and the vehicle for exploitation is OGNL. I think this might be some of the relevant code changes in Struts - http://www.mail-archive.com/commits%40struts.apache.org/msg14591.html |
I'm working on converting your module to be able to load a java payload instead of executing a command |
Guys, careful on the 'vuln struts2 package', my anti-virus detected a trojan horse inside. |
@5p4d3: Did you install the module? |
how to install ?? i tried to update it but still it failed to load the module.. |
@5p4d3: It isn't even in the tree yet. Drop the module in |
still the error exists :( |
Did you reload Metasploit? This is not the place to be asking support questions, btw. Take it to IRC, please. |
Is there any way to fix this issue rather having upgrade to 2.3.32 or 2.5.10.1? |
The simplest way is to filter out all incoming requests with invalid |
or implement a custom |
If your application server is behind Apache server you can unset Content-type like this: If you application server is not behind a web server you can commented the fileUpload interceptor This temporary solution will break upload functionalities until you upgrade struts-2 |
We have released two plugins that can help you fix this vulnerability in your Struts version (without a need to migrate) - it's safer than a custom Servlet filter as there are other attack vectors. |
Apache Struts S2-046https://cwiki.apache.org/confluence/display/WW/S2-046 Keep hot. |
Based on this recent qualsys blog, removing fileupload interceptor is not enough. Until you upgrade to recent revision with fix do this: If your application server is behind Apache server do: If you application server is not behind a web server remove fileupload or use jakarta-stream: |
|
Hello, Can anyone let me know if we can use Pell Parser, would it be better or secure option ? Also, kindly let me know if any issues/vulnerabilities with exploits (Attack Vectors) available for the same. Thanks. |
seem it will upload script such as window or linux bash script then running to create process. |
Hey, noob here, how can I run this exploit over https? I am getting an error, when testing against 2.3.32 (see below) it is requiring a certificate. My question is, how (if I can) can I pass in the certificate in-line, or is there a way to perform this using some type of insecure option?
|
@Lopesy1191 The Metasploit module should work fine with TLS. Use that instead of the PoC posted here. |
Replace by:
|
Thanks @WHK102 |
@ lukaszlenart : Are the plugins, you mentioned above compatible with much older Struts2 versions such as Struts 2.0.14 ? |
@casseusclay nope |
Lab
References
https://cwiki.apache.org/confluence/display/WW/S2-045
https://www.seebug.org/vuldb/ssvid-92746
The text was updated successfully, but these errors were encountered: