[Vulnerability Recurrence] Apache Struts2 CVE-2023-50164

Vulnerability description

In multiple affected versions of Apache Struts 2, due to flaws in the file upload logic, threat actors can manipulate file upload parameters to cause path traversal. In some cases, malicious files may be uploaded, causing remote code execution.

Affected version

Struts 2.5.0-Struts 2.5.32
Struts 6.0.0-Struts 6.3.0

Environment setup

Struts 6.3.0

<dependency>
      <groupId>org.apache.struts</groupId>
      <artifactId>struts2-core</artifactId>
      <version>6.3.0</version>
</dependency>

Use IDEA to create a maven project, check Create from archetype, and then select the one as shown below.
Insert image description here
Then just take the next step

Configure the struts2 dependency of the pom.xml file

Add dependencies in pom.xml

    <dependency>
      <groupId>org.apache.struts</groupId>
      <artifactId>struts2-core</artifactId>
      <version>6.3.0</version>
    </dependency>

Insert image description here

Define an UploadAction

package com.struts2;

import com.opensymphony.xwork2.ActionSupport;
import org.apache.commons.io.FileUtils;
import org.apache.struts2.ServletActionContext;

import java.io.*;

public class UploadAction extends ActionSupport {
    
    

    private static final long serialVersionUID = 1L;


    private File upload;

    // 文件类型，为name属性值 + ContentType
    private String uploadContentType;

    // 文件名称，为name属性值 + FileName
    private String uploadFileName;

    public File getUpload() {
    
    
        return upload;
    }

    public void setUpload(File upload) {
    
    
        this.upload = upload;
    }

    public String getUploadContentType() {
    
    
        return uploadContentType;
    }

    public void setUploadContentType(String uploadContentType) {
    
    
        this.uploadContentType = uploadContentType;
    }

    public String getUploadFileName() {
    
    
        return uploadFileName;
    }

    public void setUploadFileName(String uploadFileName) {
    
    
        this.uploadFileName = uploadFileName;
    }

    public String doUpload() {
    
    
        String path = "D:\\up\\";
        String realPath = path + File.separator +uploadFileName;
        try {
    
    
            FileUtils.copyFile(upload, new File(realPath));
        } catch (Exception e) {
    
    
            e.printStackTrace();
        }
        return SUCCESS;
    }

}

struts.xml

In struts.xml, this file is usually under the /WEB-INF/classes path of the project path by default.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE struts PUBLIC
        "-//Apache Software Foundation//DTD Struts Configuration 2.0//EN"
        "http://struts.apache.org/dtds/struts-2.0.dtd">
<struts>
    <package name="upload" extends="struts-default">
        <action name="upload" class="com.struts2.UploadAction" method="doUpload">
            <result name="success" type="">/index.jsp</result>
        </action>
    </package>
</struts>

Insert image description here

Configure the filter in web.xml

<!DOCTYPE web-app PUBLIC
 "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
 "http://java.sun.com/dtd/web-app_2_3.dtd" >

<web-app>
  <display-name>Archetype Created Web Application</display-name>

  <filter>
    <filter-name>struts2</filter-name>
    <filter-class>org.apache.struts2.dispatcher.filter.StrutsPrepareAndExecuteFilter</filter-class>
  </filter>
  <filter-mapping>
    <filter-name>struts2</filter-name>
    <url-pattern>*.action</url-pattern>
  </filter-mapping>


</web-app>

index.jsp

<html>
<body>
<h2>Hello World!</h2>
<form action="upload.action" method="post" enctype="multipart/form-data">
    <input type="file" name="Upload" />
    <input type="submit" value="Upload" />
</form>
</body>
</html>

Run the access to indicate that the build is successful.
Insert image description here