st2-046-poc

Struts2 Content-Disposition filename null-byte variant of CVE-2017-5638 Struts2 Security Bulletin S2-046 A null byte \x00 in a request¡¯s Content-Disposition header filename field can trigger a InvalidFileNameException with the same client controlled filename string in the exception message that ...

struts2-tool

Struts2 Vulnerability Detection and Exploitation Tool s2tool A pure Java implementation of a Struts2 S2-045 / S2-046 CVE-2017-5638 vulnerability detection and exploitation tool. The detection module covers both the S2-045 / S2-046 vulnerabilities, and the exploitation module provides capabilities...

S2-046_S2-045_POC

S2-046POC Usage: ./s2046.sh url ./s2045.sh url Sample: 1. chmod +x ./s2046.sh 2. ./s2046.sh http://172.16.152.135/index.action OUTPUT: ================HTTP GET Method================ uid=0root gid=0root groups=0root context=unconfinedu:unconfinedr:unconfinedjavat:s0-s0:c0.c1023 uid=0root gid=0roo...

Exploit for Improper Handling of Exceptional Conditions in Apache Struts

Struts2 Vulnerability Detection and Exploitation Tool s2tool...

Apache Struts 2.3.5 < 2.3.32 / 2.5.x < 2.5.10.1 Remote Code Execution (S2-045 / S2-046)

The Jakarta Multipart parser in Apache Struts 2 2.3.5 to 2.3.31 and 2.5.x to 2.5.10 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or...

Struts2 S2-046 vulnerability principles of analysis-vulnerability warning-the black bar safety net

Struts2 and blast a level of high-risk vulnerabilities---S2-046, a closer look, S2-046 and S2-045 vulnerability trigger points, the use of different ways. But also because the S2-046 and S2-045 trigger point is the same, so before through the upgrade or patch way to patch S2-045 vulnerability of...

Strust2 S2-046 remote code execution vulnerability two trigger point analysis-vulnerability warning-the black bar safety net

S2-046 vulnerability and S2-045 vulnerability is very similar, are by the error message into the buildErrorMessage this method caused. But this time there are two trigger points. Content-Length the length of value exceeds length Content-Disposition the filename there is an empty byte 0x01...