CVE-2023-50164-POC

This is a Proof of Concept PoC for CVE-2023-50164, which outlines a new path traversal vulnerability which can lead to Remote Code Execution RCE in struts-core. To remediate the issue, it is advised that you update to Struts 2.5.33 or Struts 6.3.0.2 or greater. This repo builds off the excellent...

The vulnerability of the struts2-core library in the Apache Struts software platform allows attackers to induce a service failure.

The vulnerability of the struts2-core library of the Apache Struts software platform is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service failures using specially crafted XML files...

The vulnerability of the struts2-core library of the Apache Struts software platform allows attackers to execute arbitrary code.

The vulnerability of the struts2-core library of the Apache Struts software platform is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending a specially crafted XSLT file...

The vulnerability of the struts2-core library in the Apache Struts software platform allows attackers to induce a service failure.

The vulnerability of the struts2-core library of the Apache Struts software platform is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service failures using specially crafted XML files...

Denial Of Service (DoS)

Struts-core is vulnerable to denial of service DoS attacks. A malicious user can pass a URL string to the application to overload the URL validation process, preventing other strings from being validated...