9.3
CVSSv2

CVE-2016-3081

Published: 26/04/2016 Updated: 12/08/2019
CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6
CVSS v3 Base Score: 8.1 | Impact Score: 5.9 | Exploitability Score: 2.2
VMScore: 977
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Summary

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote malicious users to execute arbitrary code via method: prefix, related to chained expressions.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

apache struts 2.0.0

apache struts 2.0.1

apache struts 2.0.2

apache struts 2.0.3

apache struts 2.0.4

apache struts 2.0.5

apache struts 2.0.6

apache struts 2.0.7

apache struts 2.0.8

apache struts 2.0.9

apache struts 2.0.10

apache struts 2.0.11

apache struts 2.0.11.1

apache struts 2.0.11.2

apache struts 2.0.12

apache struts 2.0.13

apache struts 2.0.14

apache struts 2.1.0

apache struts 2.1.1

apache struts 2.1.2

apache struts 2.1.3

apache struts 2.1.4

apache struts 2.1.5

apache struts 2.1.6

apache struts 2.1.8

apache struts 2.1.8.1

apache struts 2.2.1

apache struts 2.2.1.1

apache struts 2.2.3

apache struts 2.2.3.1

apache struts 2.3.1

apache struts 2.3.1.1

apache struts 2.3.1.2

apache struts 2.3.3

apache struts 2.3.4

apache struts 2.3.4.1

apache struts 2.3.7

apache struts 2.3.8

apache struts 2.3.12

apache struts 2.3.14

apache struts 2.3.14.1

apache struts 2.3.14.2

apache struts 2.3.14.3

apache struts 2.3.15

apache struts 2.3.15.1

apache struts 2.3.15.2

apache struts 2.3.15.3

apache struts 2.3.16

apache struts 2.3.16.1

apache struts 2.3.16.2

apache struts 2.3.16.3

apache struts 2.3.20

apache struts 2.3.20.1

apache struts 2.3.24

apache struts 2.3.24.1

apache struts 2.3.28

oracle siebel e-billing 7.1

Vendor Advisories

Apache Struts 2x before 23202, 2324x before 23242, and 2328x before 23281, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions ...
Support My AccountForcepoint Support Site Guest User (Logout)Community My Account Visitor(login)Community CVE-2016-3081 Apache Struts 2 security vulnerability Article Number: 000008684 Products: Email Security ...
Oracle Critical Patch Update Advisory - July 2016 Description A Critical Patch Update (CPU) is a collection of patches for multiple security vulnerabilities Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the previous C ...
Oracle Critical Patch Update Advisory - October 2016 Description A Critical Patch Update (CPU) is a collection of patches for multiple security vulnerabilities Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the previou ...

Exploits

## # This module requires Metasploit: metasploitcom/download # Current source: githubcom/rapid7/metasploit-framework ## require 'msf/core' class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::EXE def initialize(info = {}) super(update ...

Metasploit Modules

Apache Struts Dynamic Method Invocation Remote Code Execution

This module exploits a remote command execution vulnerability in Apache Struts version between 2.3.20 and 2.3.28 (except 2.3.20.2 and 2.3.24.2). Remote Code Execution can be performed via method: prefix when Dynamic Method Invocation is enabled.

msf > use exploit/multi/http/struts_dmi_exec
      msf exploit(struts_dmi_exec) > show targets
            ...targets...
      msf exploit(struts_dmi_exec) > set TARGET <target-id>
      msf exploit(struts_dmi_exec) > show options
            ...show and set options...
      msf exploit(struts_dmi_exec) > exploit

Github Repositories

Proof of concept of S02-32 Apache Struts2服务在开启动态方法调用(DMI)的情况下,可以被远程执行任意命令,该漏洞编号为CVE-2016-3081,提供的POC仅供学习及测试使用,否则请及时删除

The EXP coding by python

PyEXP The EXP coding by python,and I'll publish the popular EXP here ##s2-032_cmdpy USG: python s2-032_cmdpy xyz/*action use '\q' to exit the shell ##s2-032_allpy usage: s2-032_allpy [-h] [--cmd] [--url URL] [-f FILENAME] [-d SHELLNAME] CVE-2016-3081 | Apache Struts S2-032 optional arguments: -h, --help show this help message and exit --cmd

环境 Requires Java 18+ and Maven 3x+ 使用方法 1下载 git clone gitoschinanet/0d/Struts2_bugsgit 2查看远程分支 git branch -a 3切换到分支 git checkout 分支名 如git checkout S2-046 4打包 mvn clean package 5部署在Tomcat中 将\target中生成的Struts2-046war复制到Tomcat下的webapps目录中,然后开启Tomcat 访问12700

J2EEScan is a plugin for Burp Suite Proxy. The goal of this plugin is to improve the test coverage during web application penetration tests on J2EE applications.

J2EEScan - J2EE Security Scanner Burp Suite Plugin What is J2EEScan J2EEScan is a plugin for Burp Suite Proxy The goal of this plugin is to improve the test coverage during web application penetration tests on J2EE applications How does it works? The plugin is fully integrated into the Burp Suite Scanner; it adds more than 70 unique security test cases and new strategies to

Exphub[漏洞利用脚本库] 包括Webloigc、Struts2、Tomcat、Nexus、Solr、Jboss、Drupal的漏洞利用脚本,最新添加CVE-2020-5902、CVE-2020-11444、CVE-2020-10204、CVE-2020-10199、CVE-2020-1938、CVE-2020-2551、CVE-2020-2555、CVE-2020-2883、CVE-2019-17558、CVE-2019-6340

Exphub Exphub[漏洞利用脚本库] (想要star~) 目前包括Webloigc、Struts2、Tomcat、Drupal的漏洞利用脚本,均为亲测可用的脚本文件,尽力补全所有脚本文件的使用说明文档,优先更新高危且易利用的漏洞利用脚本 部分脚本或文件是搜集的,若有版权要求联系即改 鹅群:219291257 bilibili:spacebi

Vulmap是一款漏洞扫描工具,可对Web容器、Web服务器、Web中间件以及CMS等Web程序进行漏洞扫描,并且具备漏洞利用功能。 相关测试人员可以使用vulmap检测目标是否存在特定漏洞,并且可以使用漏洞利用功能验证漏洞是否真实存在。

Vulmap - Vulnerability scanning and verification tools 中文版本(Chinese Version) русский(Russian Version) Vulmap is a vulnerability scanning tool that can scan for vulnerabilities in Web containers, Web servers, Web middleware, and CMS and other Web programs, and has vulnerability exploitation functions Relevant testers can use vulmap to detect whether the target ha