Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/yangyanglo/cve-2024-53677
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration Testing
GitHubyangyanglo/cve-2024-53677

CVE-2024-53677

Proof-of-concept exploit for CVE-2024-53677 (S2-067), an Apache Struts2 file upload logic bypass enabling remote code execution via crafted filename parameters.

View Repository
31431 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

POC from

https://y4tacker.github.io/2024/12/16/year/2024/12/Apache-Struts2-%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E9%80%BB%E8%BE%91%E7%BB%95%E8%BF%87-CVE-2024-53677-S2-067/

RCE Conditions

  • No restriction on dangerous file extensions
  • File name obtained from upload parameters when uploading files

Therefore, mitigation is also simple: restrict file extensions, use custom random file names, etc.

Script Usage

root@kitploit:~
python3 s2-067.py -h
image
root@kitploit:~
python3 s2-067.py -u http://localhost:28080/uploadFile -filename ../poc.jsp -file 2.jsp -type s
image
Download Tool