Description
Apache Struts 2是美国阿帕奇（Apache）基金会的一个用于开发Java EE网络应用程序的开放源代码网页应用程序架构。 Apache Struts 2 2.3.32之前的2 2.3.x版本和2.5.10.1之前的2.5.x版本中的Jakarta Multipart解析器存在输入验证错误漏洞，该漏洞源于程序没有正确处理文件上传。远程攻击者可借助带有＃cmd=字符串的特制Content-Type HTTP头利用该漏洞执行任意命令。
Apache Struts 2 输入验证错误漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.hkcert.org/tc/security-bulletin/apache-struts-2-dynamic-method-invocation-dmi-input-validation-vulnerability
https://www.cnblogs.com/mt0u/p/16138615.html
https://www.anquanke.com/post/id/266386
https://zone.huoxian.cn/d/1239-apache-struts2
https://www.secrss.com/articles/24780
https://cloud.tencent.com/developer/article/2101122
https://blog.csdn.net/weixin_66717977/article/details/129694087
https://developer.aliyun.com/article/1160434
https://su18.org/post/struts2-1/
https://stack.chaitin.com/vuldb/detail/d46550fc-f6ea-4432-a40c-e9566d943779
https://rivers.chaitin.cn/blog/cqctcip0lne9n03rn270
https://xygeni.io/zh-CN/blog/understanding-cve-2023-50164-exploit/
https://cve.imfht.com/detail/CVE-2017-5638
https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTS-30042
https://nvd.nist.gov/vuln/detail/cve-2017-5638
https://www.dynatrace.com/news/blog/the-anatomy-of-broken-apache-struts-2-a-technical-deep-dive-into-cve-2024-53677/