cve/2019/CVE-2019-0230.md

CVE-2019-0230

Description

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

POC

Reference

• http://packetstormsecurity.com/files/160108/Apache-Struts-2.5.20-Double-OGNL-Evaluation.html
• http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html
• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://www.oracle.com/security-alerts/cpujan2021.html
• https://www.oracle.com/security-alerts/cpuoct2021.html

Github

• https://github.com/0day666/Vulnerability-verification
• https://github.com/0xT11/CVE-POC
• https://github.com/20142995/Goby
• https://github.com/20142995/sectool
• https://github.com/360quake/papers
• https://github.com/ARPSyndicate/cve-scores
• https://github.com/ARPSyndicate/cvemon
• https://github.com/ARPSyndicate/kenzer-templates
• https://github.com/Al1ex/CVE-2019-0230
• https://github.com/BH2UOL/CVE-2019-0230
• https://github.com/Elsfa7-110/kenzer-templates
• https://github.com/Elymaro/Struty
• https://github.com/HimmelAward/Goby_POC
• https://github.com/IkerSaint/VULNAPP-vulnerable-app
• https://github.com/Luhaozhhhe/360_Practice_and_Training
• https://github.com/NyxAzrael/Goby_POC
• https://github.com/PrinceFPF/CVE-2019-0230
• https://github.com/SexyBeast233/SecBooks
• https://github.com/StarCrossPortal/scalpel
• https://github.com/Threekiii/Awesome-Exploit
• https://github.com/Threekiii/Awesome-POC
• https://github.com/Threekiii/Vulhub-Reproduce
• https://github.com/TrojanAZhen/Self_Back
• https://github.com/XiaomingX/awesome-poc-for-red-team
• https://github.com/Z0fhack/Goby_POC
• https://github.com/Zero094/Vulnerability-verification
• https://github.com/alphaSeclab/sec-daily-2020
• https://github.com/anonymous364872/Rapier_Tool
• https://github.com/apif-review/APIF_tool_2024
• https://github.com/apit-review-account/apit-tool
• https://github.com/bakery312/Vulhub-Reproduce
• https://github.com/bright-angel/sec-repos
• https://github.com/brunsu/woodswiki
• https://github.com/d4n-sec/d4n-sec.github.io
• https://github.com/developer3000S/PoC-in-GitHub
• https://github.com/directcyber/playbook
• https://github.com/f8al/CVE-2019-0230-PoC
• https://github.com/fengziHK/CVE-2019-0230
• https://github.com/gh0st27/Struts2Scanner
• https://github.com/hectorgie/PoC-in-GitHub
• https://github.com/hy30nq/WHS_Struts2-S2-059-
• https://github.com/hyeonql/WHS
• https://github.com/hyeonql/WHS_Struts2-S2-059-
• https://github.com/ice0bear14h/struts2scan
• https://github.com/killvxk/Awesome-Exploit
• https://github.com/nomi-sec/PoC-in-GitHub
• https://github.com/pctF/vulnerable-app
• https://github.com/ramoncjs3/CVE-2019-0230
• https://github.com/s1kr10s/Apache-Struts-v4
• https://github.com/superlink996/chunqiuyunjingbachang
• https://github.com/techgyu/WHS
• https://github.com/tw-eason-tseng/CVE-2019-0230_Struts2S2-059
• https://github.com/woods-sega/woodswiki
• https://github.com/ynsmroztas/Apache-Struts-V4
• https://github.com/youcans896768/APIV_Tool