cve/2017/CVE-2017-9804.md

CVE-2017-9804

Description

In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.

POC

Reference

No PoCs from references.

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/IkerSaint/VULNAPP-vulnerable-app
• https://github.com/PEAKWEI/WsylibBookRS
• https://github.com/khodges42/Etrata
• https://github.com/pctF/vulnerable-app
• https://github.com/wemindful/WsylibBookRS