Anno
2026
10 letters
Fri, July 17
Struts2漏洞合集

S2-032: Remote Code Execution Vulnerability (CVE-2016-3081)

This document details the Apache Struts2 S2-032 remote code execution vulnerability, affecting versions 2.3.20 to 2.3.28 (excluding specific patches). It occurs when Dynamic Method Invocation is enabled, allowing the `method:<name>` syntax to evaluate OGNL expressions. The vulnerability can be exploited by sending a crafted URL to execute arbitrary commands like `id`. The document provides links for further details and instructions to set up a vulnerable environment using Struts2 2.3.28.

Letter №14Read full note →
Fri, July 17
Struts2漏洞合集

S2-016 Remote Code Execution Vulnerability

Struts2 versions 2.0.0 to 2.3.15 are affected by a vulnerability where the DefaultActionMapper class allows OGNL expressions to be appended to navigation prefixes like 'action:', 'redirect:', and 'redirectAction:'. Without proper filtering, this enables arbitrary system command execution by visiting a URL such as http://your-ip:8080/index.action?redirect:OGNL_expression. Attackers can retrieve web directories, write webshells, and execute commands.

Letter №13Read full note →
Fri, July 17
Struts2漏洞合集

S2-015: Remote Code Execution Vulnerability

This document describes Apache Struts2 vulnerability S2-015, affecting versions 2.0.0 to 2.3.14.2. The vulnerability arises when an Action wildcard '*' is configured as a dynamic value, causing OGNL expression execution during parsing. This can lead to remote command execution, though special characters like /, ", and \ are restricted. In Struts 2.3.14.1-2.3.14.2, the setAllowStaticMethodAccess method was removed, preventing direct modification of allowStaticMethodAccess. To execute commands, dynamic methods like (new java.lang.ProcessBuilder('calc')).start() or Java reflection can be used. The document also covers a secondary execution scenario where a Result configuration in struts.xml references an Action variable via ${param}, triggering OGNL expression execution when the variable value is parsed from request parameters.

Letter №12Read full note →
Fri, July 17
Struts2漏洞合集

S2-013 / S2-014 Remote Code Execution Vulnerability

The text details Apache Struts2 vulnerabilities S2-013 and S2-014, affecting versions 2.0.0 to 2.3.14.1. The vulnerability lies in the `<s:a>` and `<s:url>` tags, which have an `includeParams` attribute set to `all`. This causes the request's GET and POST parameters to be placed in the URL and rendered via OGNL, leading to arbitrary command execution. A proof-of-concept URL is provided. S2-014 is a patch for S2-013, which failed to block `${ognl_exp}` OGNL expression execution.

Letter №11Read full note →
Fri, July 17
Struts2漏洞合集

S2-012: A Remote Code Execution Vulnerability

Struts2 S2-012 vulnerability affects versions 2.1.0 to 2.3.13. It occurs when using redirect type results with ${param_name} as redirect variables in Action configuration. During redirect, Struts2 evaluates OGNL expressions in the parameter value, allowing arbitrary command execution. The exploit is straightforward as there is no sandbox or character restrictions, similar to S2-001.

Letter №10Read full note →
Fri, July 17
Struts2漏洞合集

S2-009 Remote Code Execution Vulnerability

This text details the Struts2 S2-009 vulnerability, affecting versions 2.1.0 to 2.3.1.1. It explains that while Struts2 fixed S2-003 by banning static method calls and S2-005 by blocking backslashes, S2-009 bypasses these defenses. If an action accepts a parameter like 'example', an OGNL expression can be placed in that parameter and executed via a crafted URL, circumventing the restrictions on special characters. The exploit is demonstrated using the 'Struts Showcase' application, specifically the 'Example5Action' which accepts a 'name' string parameter. By placing OGNL code in the 'name' parameter and accessing the corresponding action URL, commands can be executed, such as creating a file in /tmp. The vulnerability is not limited to this specific application; any parameter passed to an action can be exploited.

Letter №8Read full note →
Fri, July 17
Struts2漏洞合集

S2-008: Remote Code Execution Vulnerability

The S2-008 vulnerability affects Apache Struts versions 2.1.0 to 2.3.1. It involves multiple issues, including OGNL expression execution via misconfigured Cookie interceptors, though limited by web container cookie character restrictions. Another aspect is the devMode feature, which exposes debug interfaces allowing direct command execution via parameters like `?debug=command&expression=<OGNL EXP>`. While these vectors are often considered impractical in production, they could potentially be exploited if a devMode-enabled application is deliberately deployed as a backdoor.

Letter №7Read full note →
Fri, July 17
Struts2漏洞合集

S2-007 远程代码执行漏洞

The Struts2 S2-007 vulnerability affects versions 2.0.0 to 2.2.3. When a validation rule is configured (e.g., UserAction-validation.xml) and a type conversion error occurs (e.g., submitting a string for an integer field), the backend concatenates the user input with single quotes and executes an OGNL expression. This allows injection of arbitrary OGNL expressions by breaking out of the string, similar to SQL injection. The exploit requires finding a form field with such validation rules that triggers a conversion error. A proof-of-concept payload for command execution is provided, though it cannot run in the test environment.

Letter №6Read full note →
Fri, July 17
Struts2漏洞合集

S2-005 Remote Code Execution Vulnerability

Affected versions: 2.0.0 - 2.1.8.1 Vulnerability details: http://struts.apache.org/docs/s2-005.html

Letter №5Read full note →
Fri, July 17
Struts2漏洞合集

S2-001 Remote Code Execution Vulnerability

The S2-001 vulnerability exploits how Struts 2 processes OGNL expressions when form validation fails. When users submit form data that fails validation, the backend uses the OGNL expression %{value} to parse and refill the submitted parameters. This allows attackers to inject malicious OGNL payloads for remote command execution. The vulnerability is commonly found in registration or login pages where the backend returns previously submitted data after validation failure. The exploit can be used to obtain Tomcat execution paths, web paths, and execute arbitrary commands using Java strings.

Letter №4Read full note →