S2-045-EXP-POC-TOOLS

CNVD-ID CNVD-2017-02474 Release Date 2017-03-07 Hazard Level High AV:N/AC:L/Au:N/C:C/I:C/A:C Affected Products Apache Struts =2.3.5, =2.5, CVE Identifier CVE-2017-5638 Problem It is possible to perform a RCE attack with a malicious Content-Type value. If the Content-Type value...

CVE-2017-5638

CVE-2017-5638 Apache Struts 2.3.5 Example:...

CVE-2017-5638

CVE-2017-5638 Apache Struts 2.0 RCE vulnerability This is a script to exploit CVE-2017-5638 - It allows an attacker to inject OS commands into a web application through the content-type header Apache Struts 2 is an open-source web application framework for developing Java EE web applications. It...

struts2_cve-2017-5638

struts2cve-2017-5638 This is a sort of Java porting of the Python exploit at: https://www.exploit-db.com/exploits/41570/. This software is written to have no external dependencies. DISCLAIMER This tool is intended for security engineers and appsec guys for security assessments. Please use this to...

CVE-2017-5638

LAB 1 — Apache Struts2 OGNL Injection CVE-2017-5638 / S2-045 I. SYSTEM ANALYSIS Attack Surface Analysis After starting the container, Struts2 logs show that the application loads familiar configuration files such as struts-default.xml , struts-plugin.xml , and struts.xml. This confirms that the...

CVE-2017-5638

CVE-2017-5638 Apache Struts 2 Introduction: Apache Struts 2 is an open source web application framework for developing Java EE Web applications,It is the second generation of the struts framework first released on 10th Oct 2006. Struts Framework is designed in a way that it helps creating Web...

CVE-2017-5638

CVE-2017-5638 The Apache Struts 2 versions 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 have a flaw in their Jakarta Multipart parser. This flaw causes incorrect handling of exceptions and generation of error messages when attempting to upload files. As a result, attackers can remotely execute...

PoC-CVE-2017-5638

PoC: Apache Struts2 CVE-2017-5638 Safe Educational Demo 📌 Overview This project is a Proof-of-Concept PoC for CVE-2017-5638 , a famous Apache Struts2 vulnerability that allowed attackers to execute arbitrary code on affected servers. ⚠️ This repository contains a safe, non-exploitative demo...

CVE-2026-125111

Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser can retain parsed data in its internal StringScanner buffer when reads end inside or immediately after multipart headers. An unauthenticated attacker can align many small parts with...

UBUNTU-CVE-2026-125111

Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser can retain parsed data in its internal StringScanner buffer when reads end inside or immediately after multipart headers. An unauthenticated attacker can align many small parts with...

XworkStruts-RCE

XworkStruts-RCE CVE-2017-5638 XworkStruts RCE Vuln test script The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrar...

Rack: Multipart parsing allows DoS via unbounded scan buffer growth

Summary Rack::Multipart::Parser reads the request body in chunks of rack.multipart.buffersize 1 MiB by default into an internal scan buffer. Parsed bytes are only discarded from that buffer when a chunk ends inside a part body. A request whose parts are sized so that every chunk ends inside, or...

GHSA-5V64-555J-WJXM Rack: Multipart parsing allows DoS via unbounded scan buffer growth

Summary Rack::Multipart::Parser reads the request body in chunks of rack.multipart.buffersize 1 MiB by default into an internal scan buffer. Parsed bytes are only discarded from that buffer when a chunk ends inside a part body. A request whose parts are sized so that every chunk ends inside, or...

EUVD-2026-120485

Rack: Multipart parsing allows DoS via unbounded scan buffer growth...

Rack: Multipart boundary ambiguity guard in Rack::Multipart::Parser can be bypassed with a quoted boundary value, allowing WAF bypass

Summary The guard added for CVE-2026-26961 GHSA-vgpv-f759-9wx3, which rejects multipart requests with more than one boundary parameter, only inspects the part of the Content-Type header after the boundary it extracts. A Content-Type whose first boundary parameter is empty or begins with a quote,...

GHSA-P8X9-V4HV-2W4G Rack: Multipart boundary ambiguity guard in Rack::Multipart::Parser can be bypassed with a quoted boundary value, allowing WAF bypass

Summary The guard added for CVE-2026-26961 GHSA-vgpv-f759-9wx3, which rejects multipart requests with more than one boundary parameter, only inspects the part of the Content-Type header after the boundary it extracts. A Content-Type whose first boundary parameter is empty or begins with a quote,...

CVE-2026-125111

Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser can retain parsed data in its internal StringScanner buffer when reads end inside or immediately after multipart headers. An unauthenticated attacker can align many small parts with...

Linux Distros Unpatched Vulnerability : CVE-2026-125111

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser can retain parsed data in its internal StringScanner...

DEBIAN-CVE-2026-125111

Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser can retain parsed data in its internal StringScanner buffer when reads end inside or immediately after multipart headers. An unauthenticated attacker can align many small parts with...

CVE-2026-125111

Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser can retain parsed data in its internal StringScanner buffer when reads end inside or immediately after multipart headers. An unauthenticated attacker can align many small parts with...