Exploiting The New Apache Struts2 Remote Code Execution [CVE 2017-5638]

A Glance at Apache Struts 2:-

Apache Struts 2 is an open-source web application framework for developing Java EE web applications. It uses and extends the Java Servlet API to encourage developers to adopt a model–view–controller (MVC) architecture. The WebWork framework spun off from Apache Struts aiming to offer enhancements and refinements while retaining the same general architecture of the original Struts framework. In December 2005, it was announced that WebWork 2.2 was adopted as Apache Struts 2, which reached its first full release in February 2007.

About CVE 2017-5638:-

Security Researcher have discovered a new Remote Code Execution Vulnerability in Jakarta Multi-part parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 using Object Graph Navigation Language (OGNL) expressions and it is being actively exploited in the wild.

About the Exploit:-

This vulnerability can be triggered if the attacker sends a modified HTTP request to upload a file to an Apache Server which uses Jakarta Multi-part parser for file upload functionality.

An attacker can executes a malicious command through the “Content-Type”or “Content-Length ”HTTP header, As shown in below screenshot.

Exploitation:-

Let’s setup a testbed application and try to exploit the vulnerability on our own server.

Steps includes: -
1. Install Apache tomcat server.
2. Deploy a vulnerable version on Apache Struts.
3. Pwnage.

Installing Tomcat: -

We can install tomcat using apt-get Package Management tool on any Debian distribution.

Note: for this demo, we are using Ubuntu 14.04 Server.

$ sudo apt-get install tomcat7 tomcat7-admin

Once the tomcat installation is done, we will need to add a privileged user to upload the apps to Tomcat. This can be achieved by modifying /etc/tomcat7/tomcat-users.xml file.

Add the below line in /etc/tomcat7/tomcat-users.xml file. (Note: you may need to modify user and password as per your need)

Once done, restart tomcat service.

$ sudo service tomcat restart

Now, you will be able to access Tomcat Web Application Manager on port 8080

http://127.0.0.1:8080/manager/html

Deployment: -

Now we need to deploy vulnerable version of apache Struts. Struts 2.3.15 can be downloaded here.

Extract the zip file, and you will find all the apache Struts files. For the purposes of this blog, we’ll use the struts2-showcase.war demo. This war file in “app” directory of the archive you just downloaded.

Login to the Tomcat Web Application Manager (http://127.0.0.1:8080/manager/html) using the credentials which you have just setup and scroll down to upload section to deploy war file.

Once the two apps are successfully deployed, they’ll be listed on the manager page under Applications. Click on the link, and you’ll go to the two Struts apps you just deployed.

Pwnage: -

In this section, we will try to exploit this vulnerability using publicly available exploit as well as using cURL.

Using the Exploit: -

The exploit can be found here.

Let’s check if the application is vulnerable or not.

From the exploit’s output, we can determine that the application is indeed vulnerable. Now let’s try to execute some system commands. For the purpose of this blog, we will execute “id” command.