Apache Struts Version 3 : Tool To Exploit 3 RCE Vulnerabilities On ApacheStruts

Apache Struts Version 3 is a tool to exploit 3 RCE vulnerabilities on ApacheStruts. Script contains the fusion of 3 vulnerabilities of type RCE on ApacheStruts, also has the ability to create server shell.

Apache Struts is a free, open-source, MVC framework for creating elegant, modern Java web applications.

Below is a full list of all changes:

  • unclosed instantiation of PrintWriter
  • Http Sessions forcefully created for all requests using I18nInterceptor with default Storage value.
  • NotSerializableException – org.apache.struts2.dispatcher.StrutsRequestWrapper
  • NotSerializableException: com.opensymphony.xwork2.inject.ContainerImpl$ConstructorInjector when using Executioner interceptor
  • ClassCastException in JarEntryRevision
  • Dependency Mapping Exception When Using PrefixBasedActionProxyFactory
  • The converter() method of com.opensymphony.xwork2.conversion.annotations.TypeConversion is now deprecated. If this method is removed in some next release, it will forbid to describe a converter by the name (id) of a Spring bean.
  • Conversion by annotation does not work
  • List of Boolean is not populated in Action class
  • JSONResult exception in struts2-json-plugin-2.5.14.1.jar
  • buttons with name=”method:METHODNAME” sometimes ignore global-allowed-methods defined in struts.xml
  • Could not create JarEntryRevision for [zip:C:/…. unknown protocol c
  • NPE in I18nInterceptor$SessionLocaleHandler.read
  • JasperReportResult: NPE When Not Using SQL Connection
  • support JSR 303 Validation Groups in BeanValidation-Plugin
  • Debug tag should not display anything when not in dev mode
  • Allow using of Initializable interface on an implementation level
  • Allowed methods inheritance
  • Allow use Jackson XML bindings to serialise / deserialise XML
  • when using an custom array as a filed in struts 2 action form textfiled data from jsp page in not populating into custom array but populating in String array or array list
  • Upgrade Spring to version 4.3.13
  • Update Log4j2 to 2.10.0

Also Read Remote Desktop Caching : Tool To Recover Old RDP

Apache Struts SHELL

php terminado
jsp proceso

CVE ADD

CVE-2013-2251 'action:', 'redirect:' and 'redirectAction'
CVE-2017-5638 Content-Type
CVE-2018-11776 'redirect:' and 'redirectAction'

Credit : Apache Software Foundation

R K

Recent Posts

Understanding the Model Context Protocol (MCP) and How It Works

Introduction to the Model Context Protocol (MCP) The Model Context Protocol (MCP) is an open…

1 day ago

The file Command – Quickly Identify File Contents in Linux

While file extensions in Linux are optional and often misleading, the file command helps decode what a…

2 days ago

How to Use the touch Command in Linux

The touch command is one of the quickest ways to create new empty files or update timestamps…

2 days ago

How to Search Files and Folders in Linux Using the find Command

Handling large numbers of files is routine for Linux users, and that’s where the find command shines.…

2 days ago

How to Move and Rename Files in Linux with the mv Command

Managing files and directories is foundational for Linux workflows, and the mv (“move”) command makes it easy…

2 days ago

How to Create Directories in Linux with the mkdir Command

Creating directories is one of the earliest skills you'll use on a Linux system. The mkdir (make…

2 days ago