pazeray/cve-2020-17533Proof-of-concept exploit for Apache Struts2 remote code execution vulnerability CVE-2020-17533, leveraging OGNL expression injection for unauthenticated RCE.
Recently, a remote code execution vulnerability was discovered in Apache Struts2 (CVE ID: CVE-2020-17530). The Apache Struts2 framework is a web framework for developing Java EE web applications. It is widely used, thus the threat impact scope is large.
Vulnerability Description If developers use the %{...} syntax, attackers can craft malicious OGNL expressions, triggering secondary parsing of OGNL expressions, resulting in remote code execution.
Scope of Impact • Apache Struts 2.0.0 - 2.5.25
Solution Upgrade the Apache Struts framework to the latest version. Relevant reference links are as follows: https://cwiki.apache.org/confluence/display/WW/S2-061
