7.5
CVSSv2

CVE-2017-12611

Published: 20/09/2017 Updated: 12/08/2019
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9
VMScore: 670
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

In Apache Struts 2.0.0 up to and including 2.3.33 and 2.5 up to and including 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.

Vulnerability Trend

Vendor Advisories

On September 7, 2017, the Apache Software Foundation released a security bulletin that disclosed a vulnerability in the Freemarker tag functionality of the Apache Struts 2 package The vulnerability could allow an unauthenticated, remote attacker to execute arbitrary code on an affected system The Apache Software Foundation classifies the vulnerab ...
It was found that Freemarker in Struts would permit using read-only properties in value assignment of tag expressions An attacker could use this to execute arbitrary code ...
Summary It was found that Freemarker in Struts would permit using read-only properties in value assignment of tag expressions An attacker could use this to execute arbitrary code Affected Products Brocade is investigating its product lines to determine which products may be affected by this vulnerability and the impact on each affected produ ...
Oracle Security Alert Advisory - CVE-2017-9805DescriptionThe Apache Foundation’s fixes for CVE-2017-5638, an Apache Struts 2 vulnerability identified by Equifax in relation to Equifax’s recent security incident, were distributed by Oracle to its customers in the April 2017 Critical Patch Update, and should have already been applied to customer ...

Github Repositories

Resources: Target Website: wwwevilcorpcom DNS: ns1nameserversnet WHOIS: whoiscorporatedomainscom Potential Redirector: wwwsilkroadme Potential Redirector: ns1webhostingcom Potential Redirector: wwwmlpforumsir Webmail Server: fakeemailscom OFF LIMITS 103101 - LoD Gateway 103100/24 Mission Objectives: Acquire some vulnerable "internet" nodes to use a

ActiveScan++ Burp Suite Plugin

ActiveScan++ ActiveScan++ extends Burp Suite's active and passive scanning capabilities Designed to add minimal network overhead, it identifies application behaviour that may be of interest to advanced testers: Potential host header attacks (password reset poisoning, cache poisoning, DNS rebinding) Edge Side Includes XML input handling Suspicious input transformation (eg

Write-ups / walkthroughs of 'boot to root' Capture The Flag (CTF) challenges

Boot to root CTFs Walkthroughs and notes of 'boot to root' CTFs mostly from VulnHub that I did for fun I like to use vulnerable VMs from VulnHub (in addition to the ones I create) to organize hands-on penetration testing training sessions for junior security auditors/consultants :-) Classic pentest methodology to do a Boot2root CTF Step 1 - Scanning and enumeratio

Write-ups / walkthroughs of 'boot to root' Capture The Flag (CTF) challenges

Boot to root CTFs Walkthroughs and notes of 'boot to root' CTFs mostly from VulnHub that I did for fun I like to use vulnerable VMs from VulnHub (in addition to the ones I create) to organize hands-on penetration testing training sessions for junior security auditors/consultants :-) Classic pentest methodology to do a Boot2root CTF Step 1 - Scanning and enumeratio

Historical loopholes

漏洞引擎 漏洞收集整理,未经作者本人同意,谢绝转载。本文采用自己文章+外链合成,外链在文末注明来源!如有侵权请联系本人删除。所有漏洞提供漏洞利用文章和利用脚本,整理在我小密圈,链接如下: 点 击这 里就可 以拿到文 章和利用poc 最新最热 |@CVE-2019-0193_Apache Solr 远程命

Exphub[漏洞利用脚本库] 包括Webloigc、Struts2、Tomcat、Nexus、Solr、Jboss、Drupal的漏洞利用脚本,最新添加CVE-2020-5902、CVE-2020-11444、CVE-2020-10204、CVE-2020-10199、CVE-2020-1938、CVE-2020-2551、CVE-2020-2555、CVE-2020-2883、CVE-2019-17558、CVE-2019-6340

Exphub Exphub[漏洞利用脚本库] (想要star~) 目前包括Webloigc、Struts2、Tomcat、Drupal的漏洞利用脚本,均为亲测可用的脚本文件,尽力补全所有脚本文件的使用说明文档,优先更新高危且易利用的漏洞利用脚本 部分脚本或文件是搜集的,若有版权要求联系即改 鹅群:219291257 bilibili:spacebi

hacking tools awesome lists

Awesome Stars A curated list of my GitHub stars! Generated by starred Contents ASP Arduino Assembly AutoHotkey AutoIt Batchfile Boo C C# C++ CMake CSS CoffeeScript Dart Dockerfile Emacs Lisp Erlang Game Maker Language Go HTML Haskell Java JavaScript Jupyter Notebook KiCad Kotlin Logos Lua M Makefile Markdown Mask Max Nginx OCaml Objective-C Objective-C++ Others PHP PLSQL P

Here is a collection about Proof of Concepts of Common Vulnerabilities and Exposures, and you may also want to check out current Contents CVE-2011-2856 CVE-2011-3243 CVE-2013-2618 CVE-2013-6632 CVE-2014-1701 CVE-2014-1705 CVE-2014-1747 CVE-2014-3176 CVE-2014-6332 CVE-2014-7927 CVE-2014-7928 CVE-2015-0072 CVE-2015-0235 CVE-2015-0240 CVE-2015-1233 CVE-2015-1242 CVE-2015-1268 CV

Awesome CVE PoC A curated list of CVE PoCs Here is a collection about Proof of Concepts of Common Vulnerabilities and Exposures, and you may also want to check out awesome-web-security Please read the contribution guidelines before contributing This repo is full of PoCs for CVEs If you enjoy this awesome list and would like to support it, check out my Patreon page :

Recent Articles

Oracle corrals and patches Struts 2 vulnerabilities
The Register • Richard Chirgwin • 27 Sep 2017

Big Red issues out-of-band patch for Apache and a few other urgent issues

Oracle has stepped outside its usual quarterly security fix cycle to address the latest Apache Struts 2 vulnerability.
Ever since it emerged at the start of September, CVE-2017-9805 has been (in the words of a former Australian prime minister) “a shiver looking for a spine to crawl up”, because so many vendors use Apache to build Web interfaces and bake Struts 2 into their their Web application framework.
Big Red's sprawling product set meant fixes had to be deployed across more ...

Oracle Patches Apache Struts, Reminds Users to Update Equifax Bug
Threatpost • Chris Brook • 26 Sep 2017

Oracle released fixes for a handful of recently patched Apache Struts 2 vulnerabilities, including a critical remote code execution vulnerability (CVE-2017-9805) that could let an attacker take control of an affected system, late last week.
The Apache Software Foundation patched the RCE vulnerability, which affects servers running apps built using the Struts framework and its REST communication plugin, earlier this month.
Scores of Oracle products, roughly two dozen in total, are aff...

Apache Struts Vulnerabilities May Affect Many of Cisco's Products
BleepingComputer • Catalin Cimpanu • 11 Sep 2017

Cisco has initiated a mass security audit of all its products that incorporate a version of the Apache Struts framework, recently affected by a series of vulnerabilities, one of which is under active exploitation.
Cisco engineers will test all the software products for four Apache Struts security bugs disclosed last week.
The company is keeping a list of To-Be-Tested, Vulnerable, and Confirmed Not Vulnerable products in two security advisories, here and here.
The first Cisco se...