r007sec/cve-2024-53677Python exploit for CVE-2024-53677 Apache Struts path traversal to remote code execution. Automates file upload parameter manipulation to achieve RCE on vulnerable Struts applications.
A critical security vulnerability, identified as CVE-2024-53677 was found in Apache Struts, allowing attackers to manipulate file upload parameters that can potentially lead to unauthorized path traversal and remote code execution (RCE).
Install PIP packages:
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
Then, run the exploit script with for example:
python3 exploit.py --url http://strutted.htb/upload.action
Note that the exploit needs a full URL where the file upload functionality is implemented.
This exploit script has been created solely for the purposes of research and for the development of effective defensive techniques. It is not intended to be used for any malicious or unauthorized activities. The author and the owner of the script disclaim any responsibility or liability for any misuse or damage caused by this software. Users are urged to use this software responsibly and only in accordance with applicable laws and regulations. Use responsibly.