mirror of
https://github.com/0xMarcio/cve.git
synced 2026-10-23 16:35:19 +00:00
7.5 KiB
7.5 KiB
CVE-2017-5638
Description
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
POC
Reference
- http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html
- http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/
- https://github.com/rapid7/metasploit-framework/issues/8064
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03723en_us
- https://isc.sans.edu/diary/22169
- https://packetstormsecurity.com/files/141494/S2-45-poc.py.txt
- https://www.exploit-db.com/exploits/41614/
- https://exploit-db.com/exploits/41570
Github
- https://github.com/0pensrcerer/struts2-rce-public
- https://github.com/0pensrcerer/struts2rce
- https://github.com/0x00-0x00/CVE-2017-5638
- https://github.com/Badbird3/CVE-2017-5638
- https://github.com/FredBrave/CVE-2017-5638-ApacheStruts2.3.5
- https://github.com/Greynad/struts2-jakarta-inject
- https://github.com/Iletee/struts2-rce
- https://github.com/JShortSona/Jenkins-Struts2
- https://github.com/Jodagh/struts
- https://github.com/Kaizhe/attacker
- https://github.com/KarzsGHR/S2-046_S2-045_POC
- https://github.com/MuhammadAbdullah192/CVE-2017-5638-Remote-Code-Execution-Apache-Struts2-EXPLOITATION
- https://github.com/NAIRBS/SC3010-Grp-33
- https://github.com/PranjalBugged-Out/Equifax-Data-Breach-Educational-Video
- https://github.com/QHxDr-dz/CVE-2017-5638
- https://github.com/R4v3nBl4ck/Apache-Struts-2-CVE-2017-5638-Exploit-
- https://github.com/SpiderMate/Stutsfi
- https://github.com/Tankirat/CVE-2017-5638
- https://github.com/TheTechSurgeon/struts2-rce-public
- https://github.com/TheTechSurgeon/struts2rce
- https://github.com/Xernary/CVE-2017-5638-POC
- https://github.com/Xhendos/CVE-2017-5638
- https://github.com/abaer123/BaerBox-Struts2-RCE
- https://github.com/acpcreation/Github-SCA
- https://github.com/aljazceru/CVE-2017-5638-Apache-Struts2
- https://github.com/amitnandi04/Common-Vulnerability-Exposure-CVE-
- https://github.com/bongbongco/cve-2017-5638
- https://github.com/c002/Apache-Struts
- https://github.com/c1apps/c1-apache-struts2
- https://github.com/cafnet/apache-struts-v2-CVE-2017-5638
- https://github.com/chanamoallim/Apache-Struts-Exploit-with-Metasploit
- https://github.com/code-sharx/struts2-rce
- https://github.com/colorblindpentester/CVE-2017-5638
- https://github.com/cx-benjamin-simpson/struts2-rce-public
- https://github.com/cx-benjamin-simpson/struts2rce
- https://github.com/delanAtMergebase/defender-demo
- https://github.com/donaldashdown/Common-Vulnerability-and-Exploit
- https://github.com/eannaratone/struts2-rce
- https://github.com/eeehit/CVE-2017-5638
- https://github.com/f5oto/hackable
- https://github.com/falcon-lnhg/StrutsShell
- https://github.com/haxerr9/CVE-2017-5638
- https://github.com/haydena23/NSESearch
- https://github.com/homjxi0e/CVE-2017-5638
- https://github.com/hook-s3c/CVE-2018-11776-Python-PoC
- https://github.com/iampetru/PoC-CVE-2017-5638
- https://github.com/immunio/apache-struts2-CVE-2017-5638
- https://github.com/initconf/CVE-2017-5638_struts
- https://github.com/injcristianrojas/cve-2017-5638
- https://github.com/izapps/c1-apache-struts2
- https://github.com/jas502n/S2-045-EXP-POC-TOOLS
- https://github.com/jas502n/st2-046-poc
- https://github.com/java-benchmark/struts2-showcase
- https://github.com/jnicastro-Sonatype/struts2-rce-github-flo-public
- https://github.com/jongmartinez/CVE-2017-5638
- https://github.com/jorgevillaescusa/c1-apache-struts2
- https://github.com/jpacora/Struts2Shell
- https://github.com/jptr218/struts_hack
- https://github.com/jrrdev/cve-2017-5638
- https://github.com/jrrombaldo/CVE-2017-5638
- https://github.com/kloutkake/CVE-2017-5638-PoC
- https://github.com/leandrocamposcardoso/CVE-2017-5638-Mass-Exploit
- https://github.com/lolwaleet/ExpStruts
- https://github.com/m3ssap0/struts2_cve-2017-5638
- https://github.com/maurycupitt/struts2-rce-github-mc
- https://github.com/mazen160/struts-pwn
- https://github.com/mcassano/cve-2017-5638
- https://github.com/mfdev-solution/Exploit-CVE-2017-5638
- https://github.com/mike-williams/Struts2Vuln
- https://github.com/mritunjay-k/CVE-2017-5638
- https://github.com/norsemen-local/lambdalabs
- https://github.com/octodemo/Moose-Dependabot-Twitch
- https://github.com/oktavianto/CVE-2017-5638-Apache-Struts2
- https://github.com/paralelo14/CVE_2017_5638
- https://github.com/payatu/CVE-2017-5638
- https://github.com/pr0x1ma-byte/cybersecurity-struts2
- https://github.com/praveenmv-git/dependabotdemo
- https://github.com/random-robbie/CVE-2017-5638
- https://github.com/readloud/CVE-2017-5638
- https://github.com/riyazwalikar/struts-rce-cve-2017-5638
- https://github.com/sUbc0ol/Apache-Struts2-RCE-Exploit-v2-CVE-2017-5638
- https://github.com/samqbush/struts2-showcase
- https://github.com/samuelproject/ApacheStruts2
- https://github.com/sealmindset/struts2rce
- https://github.com/secretmike/demo-app
- https://github.com/seeewhy/sonatype-nexus-community
- https://github.com/sighup1/cybersecurity-struts2
- https://github.com/sjitech/test_struts2_vulnerability_CVE-2017-5638
- https://github.com/sn-ravance/struts2-rce
- https://github.com/sonatype-workshops/struts2-rce
- https://github.com/sonatype/sonatype-field-workshop
- https://github.com/sotudeko/struts2-rce
- https://github.com/ss9214/cs564capstone
- https://github.com/stnert/cybersec-pwn-pres
- https://github.com/tahmed11/strutsy
- https://github.com/tomgranados/struts-rce
- https://github.com/toothbrushsoapflannelbiscuits/cve-2017-5638
- https://github.com/tsheth/JavaStruts-App-Terraform
- https://github.com/un4ckn0wl3z/CVE-2017-5638
- https://github.com/wangeradd1/MyPyExploit
- https://github.com/win3zz/CVE-2017-5638
- https://github.com/xeroxis-xs/Computer-Security-Apache-Struts-Vulnerability
- https://github.com/xsscx/cve-2017-5638
- https://github.com/zacharie410/Exploiting-Web-Apps
- https://github.com/AIPEACS/SC3010-Computer-Security
- https://github.com/Dungsocool/CVE-2017-5638
- https://github.com/smancke/CVE-2017-5638
- https://github.com/btamburi/strutszeiro
- https://github.com/xieyanran/Metasploit-Agent
- https://github.com/ajhaigh/struts2-rce