Description
Apache Struts2 S2-067漏洞是由于框架对特定请求处理不当导致的远程代码执行漏洞。攻击者可通过精心构造的恶意请求，利用/index.action路径上传恶意文件或执行任意代码。该漏洞主要影响未正确配置或使用过时版本的Struts2应用，尤其在文件上传功能中未严格过滤用户输入时风险加剧。
Apache Struts2 S2-067 /index.action 文件上传漏洞（CVE-2024-53677）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-53677
https://cwiki.apache.org/confluence/display/WW/S2-067
https://blog.qualys.com/vulnerabilities-threat-research/2024/12/16/critical-apache-struts-file-upload-vulnerability-cve-2024-53677-risks-implications-and-enterprise-countermeasures
https://github.com/TAM-K592/CVE-2024-53677-S2-067
https://www.sonicwall.com/blog/apache-struts-path-traversal-to-rce-cve-2024-53677
https://www.dynatrace.com/news/blog/the-anatomy-of-broken-apache-struts-2-a-technical-deep-dive-into-cve-2024-53677/
https://access.redhat.com/security/cve/cve-2024-53677
https://www.cyber.gc.ca/en/alerts-advisories/cve-2024-53677-vulnerability-impacting-apache-struts-2
https://nsfocusglobal.com/apache-struts-arbitrary-file-upload-vulnerability-s2-067-cve-2024-53677/
https://www.acunetix.com/vulnerabilities/web/apache-struts-path-traversal-s2-067-cve-2024-53677-s2-066-cve-2023-50164/