Description
Apache Struts 2.2.3.1之前的2版本中存在漏洞，该漏洞源于在处理转换错误时评估字符串为OGNL表达式。远程攻击者可利用此漏洞借助无效的输入，修改run-time数据值，进而执行任意代码。
Apache Struts任意代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.cnblogs.com/milantgh/p/5440409.html
https://www.secrss.com/articles/24780
https://developer.aliyun.com/article/504138
https://oopsdc.com/post/apache%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0/
https://blog.csdn.net/Myon5/article/details/136633267
https://bbs.kanxue.com/thread-284874.htm
https://www.anquanke.com/post/id/266386
http://xxc.snnu.edu.cn/info/1026/3622.htm
https://blog.nsfocus.net/apache-struts2-remote-code-execution-vulnerability-analysis-program/
https://cloud.tencent.com/developer/article/2480487
https://help.aliyun.com/zh/acsg/apache-struts2-remote-code-execution-vulnerability
https://www.javasec.org/java-vuls/Struts/Struts2-3.html
https://blog.trendmicro.com.tw/?p=48407
https://zhuanlan.zhihu.com/p/10285648643
https://www.51cto.com/article/804311.html
https://cryin.github.io/blog/struts2-vulnerability-analysis-and-OGNL-research/
https://it.ruc.edu.cn/wlaq/6a6b752e54c04534a8c1c5592acf56b2.htm
https://su18.org/post/struts2-5/
https://github.com/Threekiii/Awesome-POC/blob/master/%E4%B8%AD%E9%97%B4%E4%BB%B6%E6%BC%8F%E6%B4%9E/Apache%20Struts2%20S2-048%20%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md
https://blog.qualys.com/vulnerabilities-threat-research/2024/12/16/critical-apache-struts-file-upload-vulnerability-cve-2024-53677-risks-implications-and-enterprise-countermeasures
https://www.blackduck.com/blog/cve-2017-5638-apache-struts-vulnerability-explained.html
https://www.endorlabs.com/learn/remote-code-execution-vulnerabilities-in-apache-struts
https://nvd.nist.gov/vuln/detail/cve-2017-5638
https://www.trendmicro.com/en_us/research/17/g/examining-cve-2017-9791-new-apache-struts-remote-code-execution-vulnerability.html
https://www.cisecurity.org/advisory/a-vulnerability-in-apache-struts2-could-allow-for-remote-code-execution_2024-141
https://www.acunetix.com/vulnerabilities/web/apache-struts2-remote-code-execution-vulnerability/
https://www.sonicwall.com/blog/apache-struts-path-traversal-to-rce-cve-2024-53677
https://unit42.paloaltonetworks.com/unit42-threat-brief-information-on-critical-apache-struts-vulnerability-cve-2018-11776/