nikitapark/cve-2023-50164-pocCVE-2023-50164 PoC Application & Exploit script
This repository is a proof of concept (PoC) of the CVE-2023-50164 vulnerability.
CVE-2023-50164 is a file path traversal vulnerability that occurs in Apache Struts web application.
An attacker could exploit this vulnerability to upload malicious file (WebShell or other Malware) to arbitrary location and make secondary attacks such as remote code execution.
The vulnerable web application, StrutsUploadApp, is containerized using Docker. Follow these steps to build and deploy the environment.
Use the provided Dockerfile to build the Docker image for StrutsUploadApp.
docker build -t struts-upload-app .
docker run -d -p 8080:8080 --name StrutsUploadApp struts-upload-app
Run the exploit script to trigger the vulnerability.
python exploit.py --url=http://localhost:8080/StrutsUploadApp/upload.action \
--file=webshell.jsp \
--file-parameter=upload \
--attempts=5