### [CVE-2013-2251](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2251)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20n%2Fa%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.

### POC

#### Reference
- http://cxsecurity.com/issue/WLB-2014010087
- http://cxsecurity.com/issue/WLB-2014010087
- http://packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.html
- http://struts.apache.org/release/2.3.x/docs/s2-016.html
- http://struts.apache.org/release/2.3.x/docs/s2-016.html
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html

#### Github
- https://github.com/0day666/Vulnerability-verification
- https://github.com/0xh4di/PayloadsAllTheThings
- https://github.com/20142995/Goby
- https://github.com/20142995/pocsuite3
- https://github.com/3vikram/Application-Vulnerabilities-Payloads
- https://github.com/84KaliPleXon3/Payloads_All_The_Things
- https://github.com/ARPSyndicate/cvemon
- https://github.com/ARPSyndicate/kenzer-templates
- https://github.com/Delishsploits/PayloadsAndMethodology
- https://github.com/Elsfa7-110/kenzer-templates
- https://github.com/GuynnR/Payloads
- https://github.com/HimmelAward/Goby_POC
- https://github.com/MelanyRoob/Goby
- https://github.com/Muhammd/Awesome-Payloads
- https://github.com/Nieuport/PayloadsAllTheThings
- https://github.com/Ostorlab/KEV
- https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors
- https://github.com/Pav-ksd-pl/PayloadsAllTheThings
- https://github.com/Ra7mo0on/PayloadsAllTheThings
- https://github.com/SexyBeast233/SecBooks
- https://github.com/Threekiii/Awesome-POC
- https://github.com/Threekiii/Vulhub-Reproduce
- https://github.com/TmmmmmR/PoCs
- https://github.com/XPR1M3/Payloads_All_The_Things
- https://github.com/Z0fhack/Goby_POC
- https://github.com/Zero094/Vulnerability-verification
- https://github.com/andrysec/PayloadsAllVulnerability
- https://github.com/anhtu97/PayloadAllEverything
- https://github.com/apkadmin/PayLoadsAll
- https://github.com/bakery312/Vulhub-Reproduce
- https://github.com/chanchalpatra/payload
- https://github.com/eescanilla/Apache-Struts-v3
- https://github.com/fadelmuharam/s2-016
- https://github.com/falocab/PayloadsAllTheThings
- https://github.com/fupinglee/Struts2_Bugs
- https://github.com/gobysec/Goby
- https://github.com/hellochunqiu/PayloadsAllTheThings
- https://github.com/ice0bear14h/struts2scan
- https://github.com/ksw9722/PayloadsAllTheThings
- https://github.com/likescam/Apache-Struts-v3
- https://github.com/merlinepedra/nuclei-templates
- https://github.com/merlinepedra25/nuclei-templates
- https://github.com/mrhacker51/ReverseShellCommands
- https://github.com/mycloudlab/network-policy-demo-apps
- https://github.com/nevidimk0/PayloadsAllTheThings
- https://github.com/nth347/CVE-2013-2251
- https://github.com/ozkanbilge/Apache-Struts
- https://github.com/ranjan-prp/PayloadsAllTheThings
- https://github.com/ravijainpro/payloads_xss
- https://github.com/retr0-13/Goby
- https://github.com/s1kr10s/Apache-Struts-v4
- https://github.com/sobinge/--1
- https://github.com/sobinge/PayloadsAllTheThings
- https://github.com/sobinge/PayloadsAllThesobinge
- https://github.com/sobinge/nuclei-templates
- https://github.com/superlink996/chunqiuyunjingbachang
- https://github.com/winterwolf32/PayloadsAllTheThings
- https://github.com/woods-sega/woodswiki
- https://github.com/ynsmroztas/Apache-Struts-V4