3086 matches found
struts-rce-cve-2017-5638
struts-rce-cve-2017-5638 Struts-RCE CVE-2017-5638 This is a modified exploit that creates a webshell and provides a bash/cmd like interface to interact with the webshell in the console...
CVE-2017-5638
CVE-2017-5638 Apache Struts 2 Introduction: Apache Struts 2 is an open source web application framework for developing Java EE Web applications,It is the second generation of the struts framework first released on 10th Oct 2006. Struts Framework is designed in a way that it helps creating Web...
apache-struts-cve-2017-5638-project
apache-struts-cve-2017-5638-project Attack and Defense course project focused on CVE-2017-5638 analysis, exploitation, and mitigation...
CVE-2025-54253-Inside-the-Adobe-AEM-Forms-Zero-Day
CVE-2025-54253: Inside the Adobe AEM-Forms Zero-Day — What Pentesters & Defenders Must Do TL;DR: Adobe Experience Manager AEM Forms on JEE ≤ 6.5.23.0 contained a critical, network-accessible flaw CVE-2025-54253 that allows unauthenticated remote code execution via misused Struts/OGNL endpoints. A...
docker-lab-cve-2017-5638-cve-2021-41773
Attacker Lab: CVE-2017-5638 & CVE-2021-41773 A 7-host Docker-based attack emulation lab designed to demonstrate a multi-stage kill chain, lateral movement, and multi-point IDS detection. Overview This lab simulates a realistic network environment where an attacker progresses from initial...
struts-s2-052-deserialization-rce-lab
Apache Struts S2-052 XML Deserialization RCE This repository demonstrates exploitation of Apache Struts S2-052 CVE-2017-9805 using malicious XML deserialization. The exploit was developed while solving the INE eWPTX Practice Range – Struts XML Deserialization RCE lab. Vulnerability Overview Apach...
CVE-2024-53677-Analysis
CVE-2024-53677 Analysis This repository contains documentation and lab artifacts prepared for analyzing CVE-2024-53677 in Apache Struts. Overview CVE-2024-53677 is a vulnerability in Apache Struts file upload handling. The issue occurs when filename-related metadata from the legacy...
CVE-2017-9805-S2-052
S2-052 POC Usage: python3 struts20179805.py Disclaimer: This script is provided for educational purposes and authorised lab use only. It is intended to demonstrate the Apache Struts S2-052 CVE-2017-9805 vulnerability in controlled environments. You are solely responsible for how you use this tool...
Apache S2-032 Struts - Remote Code Execution
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when dynamic method invocation is enabled, allows remote attackers to execute arbitrary code via method: prefix related to chained expressions. id: CVE-2016-3081 info: name: Apache S2-032 Struts - Remote Code Execution...
Apache Struts2 S2-053 - Remote Code Execution
Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1 uses an unintentional expression in a Freemarker tag instead of string literals, which makes it susceptible to remote code execution attacks. id: CVE-2017-12611 info: name: Apache Struts2 S2-053 - Remote Code Execution author: pikpikcu...
Apache Struts2 S2-062 - Remote Code Execution
Apache Struts2 S2-062 is vulnerable to remote code execution. The fix issued for CVE-2020-17530 S2-061 was incomplete, meaning some of the tag's attributes could still perform a double evaluation if a developer applied forced OGNL evaluation by using the %... syntax. id: CVE-2021-31805 info: name...
OpenSymphony XWork/Apache Struts2 - Remote Code Execution
Apache Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language OGNL expression when altSyntax is enabled, which allows remote attackers to cause a denial of service infini...
Apache Struts2 S2-057 - Remote Code Execution
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible remote code execution when alwaysSelectFullNamespace is true either by user or a plugin like Convention Plugin and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace...
Apache Struts <2.3.1.1 - Remote Code Execution
Apache Struts before 2.3.1.1 is susceptible to remote code execution. When developer mode is used in the DebuggingInterceptor component, a remote attacker can execute arbitrary OGNL commands via unspecified vectors, which can allow for execution of malware, obtaining sensitive information,...
Apache Struts - Multiple Open Redirection Vulnerabilities
Apache Struts is prone to multiple open-redirection vulnerabilities because the application fails to properly sanitize user-supplied input. id: CVE-2013-2248 info: name: Apache Struts - Multiple Open Redirection Vulnerabilities author: 0xAkoko severity: medium description: Apache Struts is prone ...
CVE-2017-12611_Exploit
CVE-2017-12611 Project Overview: A RCE attack is possible with the given payload. Environment & Tools The following lists the environments and tools for testing and validation in an isolated, personal lab. Host OS : Ubuntu 18.04.6 Attacker OS : Kali Linux Container Platform : Docker Target...
CVE-2023-50164-HTB-strutted
CVE-2023-50164: A critical security vulnerability, identified as CVE-2023-50164 CVE: 9.8 was found in Apache Struts, allowing attackers to manipulate file upload parameters that can potentially lead to unauthorized path traversal and remote code execution RCE. It is intended only for educational,...
struts-uploader-vulnerability
CVE-2024-53677 — How the Exploit Works and How to Run It Vulnerability summary The flaw is in how Struts' FileUploadInterceptor hands off the uploaded filename to the action class. Normally the interceptor sanitizes the filename, but Struts also lets any multipart parameter be processed as an OGN...
CVE-2025-68493
CVE-2025-68493 CVE-2025-68493 7. References 1 Apache Struts XWork XML Vulnerability CVE-2025-68493 PoC and Script | ZONE.CI Global Network. https://zone.ci/secarticles/wx/486533.html 8. Vulnerability Verification and Exploitation To verify and exploit the CVE-2025-68493 vulnerability, you can use...