update S2-069 vulnerability environment

base/struts2/s2-069/Dockerfile

@@ -0,0 +1,16 @@
+FROM maven:3.9.9-eclipse-temurin-11
+
+WORKDIR /build
+COPY pom.xml .
+COPY src ./src
+
+RUN mvn clean package -DskipTests
+
+
+FROM tomcat:9.0.96-jdk11
+
+RUN rm -rf /usr/local/tomcat/webapps/ROOT
+
+COPY --from=0 \
+     /build/target/CVE-2025-68493.war \
+     /usr/local/tomcat/webapps/ROOT.war

base/struts2/s2-069/docker-compose.yml

@@ -0,0 +1,5 @@
+services:
+  struts2:
+    build: .
+    ports:
+      - "8080:8080"

base/struts2/s2-069/pom.xml

@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="
+           http://maven.apache.org/POM/4.0.0
+           http://maven.apache.org/xsd/maven-4.0.0.xsd">
+
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>org.example</groupId>
+    <artifactId>CVE-2025-68493</artifactId>
+    <version>1.0-SNAPSHOT</version>
+    <packaging>war</packaging>
+
+    <name>CVE-2025-68493 PoC</name>
+
+    <properties>
+        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <maven.compiler.source>8</maven.compiler.source>
+        <maven.compiler.target>8</maven.compiler.target>
+        <struts2.version>2.5.25</struts2.version>
+    </properties>
+
+    <dependencies>
+
+        <dependency>
+            <groupId>org.apache.struts</groupId>
+            <artifactId>struts2-core</artifactId>
+            <version>${struts2.version}</version>
+        </dependency>
+
+        <dependency>
+            <groupId>commons-collections</groupId>
+            <artifactId>commons-collections</artifactId>
+            <version>3.2.2</version>
+        </dependency>
+
+        <dependency>
+            <groupId>javax.servlet</groupId>
+            <artifactId>javax.servlet-api</artifactId>
+            <version>3.1.0</version>
+            <scope>provided</scope>
+        </dependency>
+
+    </dependencies>
+
+    <build>
+        <finalName>CVE-2025-68493</finalName>
+    </build>
+
+</project>

base/struts2/s2-069/src/main/java/org/example/actions/XXEAction.java

@@ -0,0 +1,56 @@
+package org.example.actions;
+
+import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.ServletResponseAware;
+import org.w3c.dom.Document;
+import org.xml.sax.InputSource;
+import javax.servlet.http.HttpServletResponse;
+import java.io.StringReader;
+import java.io.PrintWriter;
+
+public class XXEAction extends ActionSupport implements ServletResponseAware {
+
+    private String xmlContent;
+    private HttpServletResponse response;
+
+    public void setServletResponse(HttpServletResponse response) {
+        this.response = response;
+    }
+
+    public String execute() throws Exception {
+        if (xmlContent != null && !xmlContent.trim().isEmpty()) {
+            try {
+                InputSource inputSource = new InputSource(new StringReader(xmlContent));
+                Document doc = com.opensymphony.xwork2.util.DomHelper.parse(inputSource);
+                String root = doc.getDocumentElement().getTagName();
+                String textContent = doc.getDocumentElement().getTextContent();
+                String result = "XML parsed. Root: " + root + "\nContent: " + textContent;
+                response.setContentType("text/plain");
+                PrintWriter out = response.getWriter();
+                out.write(result);
+                out.flush();
+                return NONE;
+            } catch (Exception e) {
+                String error = "Error: " + e.getMessage();
+                response.setContentType("text/plain");
+                PrintWriter out = response.getWriter();
+                out.write(error);
+                out.flush();
+                return NONE;
+            }
+        }
+        response.setContentType("text/plain");
+        PrintWriter out = response.getWriter();
+        out.write("No XML provided");
+        out.flush();
+        return NONE;
+    }
+
+    public String getXmlContent() {
+        return xmlContent;
+    }
+
+    public void setXmlContent(String xmlContent) {
+        this.xmlContent = xmlContent;
+    }
+}

base/struts2/s2-069/src/main/resources/struts.xml

@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!DOCTYPE struts PUBLIC
+        "-//Apache Software Foundation//DTD Struts Configuration 2.0//EN"
+        "http://struts.apache.org/dtds/struts-2.0.dtd">
+
+<struts>
+
+    <constant name="struts.devMode" value="false"/>
+    <!--<constant name="struts.custom.i18n.resources" value="global"/>-->
+    <!-- <constant name="struts.multipart.parser" value="jakarta-stream" /> -->
+    <!--constant name="struts.multipart.maxSize" value="1" /-->
+
+    <package name="default" namespace="/" extends="struts-default">
+        <default-action-ref name="demo"/>
+        <action name="demo" class="org.example.actions.XXEAction">
+            <result>/index.jsp</result>
+        </action>
+    </package>
+
+</struts>

base/struts2/s2-069/src/main/webapp/WEB-INF/web.xml

@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
+         version="4.0">
+    <filter>
+        <filter-name>struts2</filter-name>
+        <filter-class>org.apache.struts2.dispatcher.filter.StrutsPrepareAndExecuteFilter</filter-class>
+    </filter>
+    <filter-mapping>
+        <filter-name>struts2</filter-name>
+        <url-pattern>/*</url-pattern>
+    </filter-mapping>
+</web-app>

base/struts2/s2-069/src/main/webapp/index.jsp

@@ -0,0 +1,14 @@
+<%@ page
+        language="java"
+        contentType="text/html; charset=UTF-8"
+        pageEncoding="UTF-8" %>
+<%@ taglib prefix="s" uri="/struts-tags" %>
+
+<html>
+<head>
+    <title>CVE-2025-68493</title>
+</head>
+<body>
+    <p>Apache Struts CVE-2025-68493 Demo</p>
+</body>
+</html>