asfandalimemon25/cve-2023-50164analysis-
CVE-2023-50164 An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.
A critical security vulnerability, identified as CVE-2023-50164 (CVE: 9.8) was found in Apache Struts, allowing attackers to manipulate file upload parameters that can potentially lead to unauthorized path traversal and remote code execution (RCE).
A simple testing application is developed for CVE analysis
First Build the application using docker build command:
docker build -t exploitable -f DOCKERFILE .
Then, Run the application using docker run command:
docker run -p 8080:8080 exploitable
In this case you can reach the app on port 8080
You can deploy it to Tomcat or any other servlet, or run it by mvn jetty:run. In this case you can reach the app on port 9999. The exploit script works only in cases when the app is deployed to Tomcat since the exploitation path is to upload a WAR webshell. However, many other exploitation path can work in case of the same vulnerability based on the used technologies and other circumstances.
Install PIP packages:
pip install requests requests_toolbelt
Then, You can change the path as per your application URL and run the below command:
python exploit.py --url http://localhost:8080/upload.action
Its recommended to run the application and exploit on Windows host. The exploit may not work on *nix based system sometimes.
This exploit script has been created for the purposes of research. It is not intended to be used for any malicious or unauthorized activities.