apache-struts-v2-CVE-2017-5638

apache-struts-v2-CVE-2017-5638 POC funcional para CVE 2017-5638 Este repositorio contiene un ejemplo funcional en python que demuestra las capacidades de RCE de CVE 2017-5638. También se incluye como referencia el archivo WAR de Struts Showcase...

CVE-2024-53677-S2-067

🚨🚨 CVE-2024-53677-S2-067🚨🚨 Aviso de seguridad: CVE-2024-53677 – Vulnerabilidad crítica de ejecución remota de código en Apache Struts Fecha del aviso: 14 de diciembre de 2024 ID de CVE: CVE-2024-53677 Puntuación CVSS: 9.5 Crítico Resumen Se ha identificado una vulnerabilidad crítica,...

struts-rce

:source-highlighter: pygments = Apache Struts CVE-2017-5638 漏洞利用 此简单 Web 应用程序使用存在漏洞的 Apache Struts 2.5.10（CVE-2017-5638）构建。它存在 RCE 漏洞。 == 启动 Web 应用程序 要启动存在漏洞的 Web 应用程序，请执行： mvn jetty:run 默认情况下，应用程序将在端口 8012 上可访问。您可以更改端口： mvn -Djetty.http.port= jetty:run == 访问 Web 应用程序 要访问存在漏洞的 Web...

Apache-Struts

Apache-Struts 用于Apache Struts CVE-2017-5638的利用工具 使用方法 测试单个URL。 python struts-pwn.py --url 'http://example.com/struts2-showcase/index.action' -c 'id' Nmap Recong nmap -p --script http-vuln-cve2017-5638 ' 测试一组URL。 python struts-pwn.py --list 'urls.txt' -c 'id' 检查单个URL是否存在漏洞。 python struts-pwn.py...

StrutsShell

StrutsShell Apache Struts（CVE-2017-5638）Shell 简介 "LowNoiseHG LNHG Struts Shell "（以下简称"StrutsShell "）诞生于2017年3月，当时我们认识到无需手动利用Apache Struts CVE-2017-5638漏洞（手动发送HTTP GET请求）的实用性，同时也发现针对该漏洞的相应Metasploit模块无法正常工作（至少在我们的测试案例中如此）。 描述 StrutsShell 的基本操作包括：处理针对被攻击平台（Windows、Linux等）的命令行（shell）输入，并利用Apache...

Exploit for Improper Handling of Exceptional Conditions in Apache Struts

Struts Patch-Gap Auditor A small Python tool that finds Apach...

XworkStruts-RCE

XworkStruts-RCE CVE-2017-5638 Script de prueba de vulnerabilidad RCE XworkStruts El analizador Jakarta Multipart en Apache Struts 2 2.3.x anteriores a 2.3.32 y 2.5.x anteriores a 2.5.10.1 tiene un manejo incorrecto de excepciones y generación de mensajes de error durante los intentos de carga de...

struts-rce-cve-2017-9805

Descripción Herramienta RCE de Apache Struts para CVE 2017-9805 Opciones u: la URL objetivo; c: el comando que se ejecutará en un objetivo vulnerable; f: verifica automáticamente RCE utilizando una lista de objetivos un objetivo por línea; p: especifica el puerto para un listener local - se usa c...

Linux Distros Unpatched Vulnerability : CVE-2026-104711

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper neutralization of special elements used in an expression language statement 'Expression Language Injection' vulnerability in Apache Struts. If the...

Linux Distros Unpatched Vulnerability : CVE-2026-104712

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Asymmetric resource consumption amplification vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal...

CVE-2026-104712

A flaw was found in Apache Struts. An unauthenticated remote attacker could cause a Denial of Service DoS by sending requests with crafted decimal parameters that are rendered through the Struts tag library. Processing these values can produce disproportionately large server responses, enabling a...

CVE-2026-104711

A flaw was found in Apache Struts. This vulnerability allows a remote attacker to achieve arbitrary code execution by submitting a specially crafted request to an application configured to use the legacy RESTful action mapper. The flaw occurs because user input is improperly evaluated as an...

CVE-2026-104711

Improper neutralization of special elements used in an expression language statement 'Expression Language Injection' vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote co...

CVE-2026-104712

Asymmetric resource consumption amplification vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal java.math.BigDecimal property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude large...

CVE-2026-104713

Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap a...

CVE-2026-104714

Concurrent execution using shared resource with improper synchronization 'race condition' vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served request...

ApacheStruts-CVE-2018-11776

Apache Struts CVE-2018-11776 Python PoC Esto está basado en https://github.com/hook-s3c/CVE-2018-11776-Python-PoC. La construcción del contenedor y las instrucciones no funcionaron como se describe en el README, por lo que se creó este fork. El exploit de PoC utilizado es de Rapid7...

EUVD-2026-92625

Concurrent execution using shared resource with improper synchronization 'race condition' vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served request...

CVE-2026-104714 Apache Struts: Shared message formatter exposes date and time values across concurrent requests

Concurrent execution using shared resource with improper synchronization 'race condition' vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served request...

CVE-2026-104714 Apache Struts: Shared message formatter exposes date and time values across concurrent requests

Concurrent execution using shared resource with improper synchronization 'race condition' vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served request...