Apache Struts Version 3 : Tool To Exploit 3 RCE Vulnerabilities On ApacheStruts

Apache Struts Version 3 is a tool to exploit 3 RCE vulnerabilities on ApacheStruts. Script contains the fusion of 3 vulnerabilities of type RCE on ApacheStruts, also has the ability to create server shell.

Apache Struts is a free, open-source, MVC framework for creating elegant, modern Java web applications.

Below is a full list of all changes:

  • unclosed instantiation of PrintWriter
  • Http Sessions forcefully created for all requests using I18nInterceptor with default Storage value.
  • NotSerializableException – org.apache.struts2.dispatcher.StrutsRequestWrapper
  • NotSerializableException: com.opensymphony.xwork2.inject.ContainerImpl$ConstructorInjector when using Executioner interceptor
  • ClassCastException in JarEntryRevision
  • Dependency Mapping Exception When Using PrefixBasedActionProxyFactory
  • The converter() method of com.opensymphony.xwork2.conversion.annotations.TypeConversion is now deprecated. If this method is removed in some next release, it will forbid to describe a converter by the name (id) of a Spring bean.
  • Conversion by annotation does not work
  • List of Boolean is not populated in Action class
  • JSONResult exception in struts2-json-plugin-2.5.14.1.jar
  • buttons with name=”method:METHODNAME” sometimes ignore global-allowed-methods defined in struts.xml
  • Could not create JarEntryRevision for [zip:C:/…. unknown protocol c
  • NPE in I18nInterceptor$SessionLocaleHandler.read
  • JasperReportResult: NPE When Not Using SQL Connection
  • support JSR 303 Validation Groups in BeanValidation-Plugin
  • Debug tag should not display anything when not in dev mode
  • Allow using of Initializable interface on an implementation level
  • Allowed methods inheritance
  • Allow use Jackson XML bindings to serialise / deserialise XML
  • when using an custom array as a filed in struts 2 action form textfiled data from jsp page in not populating into custom array but populating in String array or array list
  • Upgrade Spring to version 4.3.13
  • Update Log4j2 to 2.10.0

Also Read Remote Desktop Caching : Tool To Recover Old RDP

Apache Struts SHELL

php terminado
jsp proceso

CVE ADD

CVE-2013-2251 'action:', 'redirect:' and 'redirectAction'
CVE-2017-5638 Content-Type
CVE-2018-11776 'redirect:' and 'redirectAction'

Credit : Apache Software Foundation

R K

Share
Published by
R K
Tags: ApacheApacheStrutsRCE vulnerabilities
8 years ago

Recent Posts

Install PHP on Ubuntu 26.04: Apache, Nginx, and Multiple Versions

PHP 8.5 is included in Ubuntu 26.04's default repositories and is the recommended version for…

4 hours ago

Upgrade to Ubuntu 26.04 from 25.10 and 24.04 LTS: Complete Guide

Ubuntu 26.04 LTS "Resolute Raccoon" arrived on April 23, 2026 with Linux kernel 7.0, GNOME 50,…

4 hours ago

Install Kubernetes on Ubuntu 26.04 with kubeadm and containerd

Kubernetes is the standard platform for running containerized workloads across multiple servers with self-healing, rolling…

4 hours ago

Install Ubuntu 26.04: Bootable USB, Partitioning, and First Steps

Ubuntu 26.04 LTS "Resolute Raccoon" was released on April 23, 2026 with Linux kernel 7.0, GNOME desktop, and standard security support until April 2031. A clean install gives you a known-good starting point on new hardware, when replacing another operating system, or when an upgrade path is not practical. This guide walks through how to install Ubuntu 26.04: downloading and verifying the ISO, writing a bootable USB drive, completing the installer, and doing the initial setup after the first boot. Before you start: You need a USB drive with at least 12 GB of free space. Back up any existing data on the target machine — the installer can erase the entire disk. Install Ubuntu 26.04: Download the ISO…

5 hours ago

Change Timezone on Ubuntu: timedatectl and Desktop GUI Guide

The correct timezone affects more than the clock on your screen. It drives cron job scheduling, systemd timer execution, log file timestamps, database record timing, and SSL certificate validity checks. A mismatched timezone can cause scheduled jobs to fire at the wrong hour and make log timestamps impossible to match with real-world events. This guide shows how to change timezone on Ubuntu using the timedatectl command (the recommended approach for servers and remote machines) and through the graphical Date & Time settings on desktop systems. The steps apply to all current Ubuntu releases including 24.04 and 26.04. <strong>Prerequisite:</strong>&nbsp;Only&nbsp;the&nbsp;root&nbsp;user&nbsp;or&nbsp;a&nbsp;user&nbsp;with&nbsp;sudo&nbsp;access&nbsp;can&nbsp;change&nbsp;the&nbsp;system&nbsp;timezone. Check the Current Timezone Before You Change It Run timedatectl with no arguments to see the active timezone and clock status: bashtimedatectl Sample output: Local…

5 hours ago

Install Atom on Ubuntu 18.04: GitHub’s Code Editor APT Setup

Atom is a free, open-source, cross-platform code editor developed by GitHub. Built on Electron, it uses…

17 hours ago