.. / CVE-2017-5638

• RCE
• Nuclei
• Web
• Hack The Box

Exploit for Apache Struts 2 - Remote Command Execution (CVE-2017-5638)

Description:

Apache Struts 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 is susceptible to remote command injection attacks. The Jakarta Multipart parser has incorrect exception handling and error-message generation during file upload attempts, which can allow an attacker to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header. This was exploited in March 2017 with a Content-Type header containing a #cmd= string.

Nuclei Template

View the template here CVE-2017-5638.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2017/CVE-2017-5638.yaml

Try the exploit in a lab environment:

References: