cmyanko/struts2-rce

Exploitable target to CVE-2017-5638

Exploit Demo for CVE-2017-5638

Completely based on https://github.com/piesecurity/apache-struts2-CVE-2017-5638

Usage:

Pre-requisites: have python, docker, maven and a jdk installed

1. clone this repo
2. run ./mvnw clean package in project root
3. run docker build -t hack .
4. run docker run -d -p 8080:8080 hack a. If 8080 is in use, map to an open port e.g. -p 8888:8080
5. once container comes online - verify by running in browser

To begin testing RCE - run the exploit.py file.

1. python exploit.py http://myserver:8080/orders/3 "CMD"

Try with different CMDs like

• pwd - where are we?
• whomai - what user are we running this?
• ls -la - what's in my directory?
• ls / - what's my machine
• ls /etc - what else we can find?

How to Fix!

Use the Nexus Lifecycle Component Information Panel to identify a non-vulnerable version of struts2-core. Update the POM to that version and rebuild.You can also rebuild the docker image and run it to retry the attack.

Also, look in the Issues here to see DepShield findings

Original readme

=========================================================================== README.txt - Rest Showcase Webapp

Rest Showcase is a simple example of REST app build with the REST plugin.

For more on getting started with Struts, see

• http://cwiki.apache.org/WW/home.html

I18N:

Please note that this project was created with the assumption that it will be run in an environment where the default locale is set to English. This means that the default messages defined in package.properties are in English. If the default locale for your server is different, then rename package.properties to package_en.properties and create a new package.properties with proper values for your default locale.

struts2-rce's Issues

[DepShield] (CVSS 7.5) Vulnerability due to usage of com.thoughtworks.xstream:xstream:1.4.8

Vulnerabilities

DepShield reports that this application's usage of com.thoughtworks.xstream:xstream:1.4.8 results in the following vulnerability(s):

• (CVSS 7.5) [CVE-2017-7957] Improper Input Validation
• (CVSS 7.5) [CVE-2016-3674] Information Exposure

---

Occurrences

com.thoughtworks.xstream:xstream:1.4.8 is a transitive dependency introduced by the following direct dependency(s):

• org.apache.struts:struts2-rest-plugin:2.5.10
        └─ com.thoughtworks.xstream:xstream:1.4.8

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 5.8) Vulnerability due to usage of commons-httpclient:commons-httpclient:3.1

Vulnerabilities

DepShield reports that this application's usage of commons-httpclient:commons-httpclient:3.1 results in the following vulnerability(s):

• (CVSS 5.8) [CVE-2014-3577] org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient be...
• (CVSS 4.3) [CVE-2015-5262] Resource Management Errors

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 9.8) Vulnerability due to usage of commons-collections:commons-collections:3.2.1

Vulnerabilities

DepShield reports that this application's usage of commons-collections:commons-collections:3.2.1 results in the following vulnerability(s):

• (CVSS 9.8) [CVE-2017-15708] In Apache Synapse, by default no authentication is required for Java Remote Meth...
• (CVSS 7.5) [CVE-2015-6420] Serialized-object interfaces in certain Cisco Collaboration and Social Media; En...

---

Occurrences

commons-collections:commons-collections:3.2.1 is a transitive dependency introduced by the following direct dependency(s):

• org.apache.struts:struts2-rest-plugin:2.5.10
        └─ net.sf.json-lib:json-lib:2.3
              └─ commons-beanutils:commons-beanutils:1.9.2
                    └─ commons-collections:commons-collections:3.2.1
              └─ commons-collections:commons-collections:3.2.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 9.8) Vulnerability due to usage of org.apache.logging.log4j:log4j-core:2.7

Vulnerabilities

DepShield reports that this application's usage of org.apache.logging.log4j:log4j-core:2.7 results in the following vulnerability(s):

• (CVSS 9.8) [CVE-2017-5645] Deserialization of Untrusted Data

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 10.0) Vulnerability due to usage of org.apache.struts:struts2-core:2.5.10

Vulnerabilities

DepShield reports that this application's usage of org.apache.struts:struts2-core:2.5.10 results in the following vulnerability(s):

• (CVSS 10.0) [CVE-2017-5638] Improper Input Validation
• (CVSS 9.8) [CVE-2018-11776] Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remo...
• (CVSS 9.8) [CVE-2017-12611] In Apache Struts 2.0.1 through 2.3.33 and 2.5 through 2.5.10, using an unintenti...
• (CVSS 7.5) [CVE-2017-9787] Improper Access Control
• (CVSS 7.5) [CVE-2017-9793] The REST Plugin in Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is ...
• (CVSS 7.5) [CVE-2017-9804] In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application ...
• (CVSS 5.9) [CVE-2017-7672] Improper Input Validation

---

Occurrences

org.apache.struts:struts2-core:2.5.10 is a transitive dependency introduced by the following direct dependency(s):

• org.apache.struts:struts2-rest-plugin:2.5.10
        └─ org.apache.struts:struts2-core:2.5.10

• org.apache.struts:struts2-convention-plugin:2.5.10
        └─ org.apache.struts:struts2-core:2.5.10

• org.apache.struts:struts2-config-browser-plugin:2.5.10
        └─ org.apache.struts:struts2-core:2.5.10

• org.apache.struts:struts2-core:2.5.10

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of org.springframework:spring-core:4.3.13.RELEASE

Vulnerabilities

DepShield reports that this application's usage of org.springframework:spring-core:4.3.13.RELEASE results in the following vulnerability(s):

• (CVSS 7.5) [CVE-2018-1272] Permissions, Privileges, and Access Controls

---

Occurrences

org.springframework:spring-core:4.3.13.RELEASE is a transitive dependency introduced by the following direct dependency(s):

• org.springframework:spring-test:4.3.13.RELEASE
        └─ org.springframework:spring-core:4.3.13.RELEASE

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of org.springframework:spring-core:4.1.6.RELEASE

Vulnerabilities

DepShield reports that this application's usage of org.springframework:spring-core:4.1.6.RELEASE results in the following vulnerability(s):

• (CVSS 7.5) [CVE-2018-1272] Permissions, Privileges, and Access Controls

---

Occurrences

org.springframework:spring-core:4.1.6.RELEASE is a transitive dependency introduced by the following direct dependency(s):

• org.springframework:spring-test:4.1.6.RELEASE
        └─ org.springframework:spring-core:4.1.6.RELEASE

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 9.8) Vulnerability due to usage of commons-fileupload:commons-fileupload:1.3.2

Vulnerabilities

DepShield reports that this application's usage of commons-fileupload:commons-fileupload:1.3.2 results in the following vulnerability(s):

• (CVSS 9.8) [CVE-2016-1000031] Improper Access Control

---

Occurrences

commons-fileupload:commons-fileupload:1.3.2 is a transitive dependency introduced by the following direct dependency(s):

• org.apache.struts:struts2-core:2.5.10
        └─ commons-fileupload:commons-fileupload:1.3.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 9.8) Vulnerability due to usage of com.fasterxml.jackson.core:jackson-databind:2.6.1

Vulnerabilities

DepShield reports that this application's usage of com.fasterxml.jackson.core:jackson-databind:2.6.1 results in the following vulnerability(s):

• (CVSS 9.8) [CVE-2018-7489] Incomplete Blacklist, Deserialization of Untrusted Data
• (CVSS 9.8) [CVE-2017-7525] Deserialization of Untrusted Data
• (CVSS 9.8) [CVE-2017-17485] Improper Control of Generation of Code ("Code Injection")
• (CVSS 9.8) [CVE-2017-15095] Deserialization of Untrusted Data
• (CVSS 8.1) [CVE-2018-5968] Incomplete Blacklist, Deserialization of Untrusted Data

---

Occurrences

com.fasterxml.jackson.core:jackson-databind:2.6.1 is a transitive dependency introduced by the following direct dependency(s):

• org.apache.struts:struts2-rest-plugin:2.5.10
        └─ com.fasterxml.jackson.core:jackson-databind:2.6.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}