asfandalimemon25/cve-2023-50164analysis-
CVE-2023-50164 An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.
A critical security vulnerability, identified as CVE-2023-50164 (CVE: 9.8) was found in Apache Struts, allowing attackers to manipulate file upload parameters that can potentially lead to unauthorized path traversal and remote code execution (RCE).
A simple testing application is developed for CVE analysis
First Build the application using docker build command:
docker build -t exploitable -f DOCKERFILE .
Then, Run the application using docker run command:
docker run -p 8080:8080 exploitable
In this case you can reach the app on port 8080
You can deploy it to Tomcat or any other servlet, or run it by mvn jetty:run. In this case you can reach the app on port . The exploit script works only in cases when the app is deployed to Tomcat since the exploitation path is to upload a WAR webshell. However, many other exploitation path can work in case of the same vulnerability based on the used technologies and other circumstances.
9999Install PIP packages:
pip install requests requests_toolbelt
Then, You can change the path as per your application URL and run the below command:
python exploit.py --url http://localhost:8080/upload.action
Its recommended to run the application and exploit on Windows host. The exploit may not work on *nix based system sometimes.
This exploit script has been created for the purposes of research. It is not intended to be used for any malicious or unauthorized activities.