7.5
CVSSv2

CVE-2017-9791

Published: 10/07/2017 Updated: 08/07/2018
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9
VMScore: 765
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

The Struts 1 plugin in Apache Struts 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.

Vulnerability Trend

Affected Products

Vendor Product Versions
ApacheStruts2.3.1, 2.3.1.1, 2.3.1.2, 2.3.3, 2.3.4, 2.3.4.1, 2.3.7, 2.3.8, 2.3.12.0, 2.3.14, 2.3.14.1, 2.3.14.2, 2.3.14.3, 2.3.15, 2.3.15.1, 2.3.15.2, 2.3.15.3, 2.3.16, 2.3.16.1, 2.3.16.2, 2.3.16.3, 2.3.20, 2.3.20.1, 2.3.20.3, 2.3.24, 2.3.24.1, 2.3.24.3, 2.3.28, 2.3.28.1, 2.3.29, 2.3.30, 2.3.31, 2.3.32

Vendor Advisories

The Struts 1 plugin in Apache Struts 23x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage ...
Oracle Security Alert Advisory - CVE-2017-9805DescriptionThe Apache Foundation’s fixes for CVE-2017-5638, an Apache Struts 2 vulnerability identified by Equifax in relation to Equifax’s recent security incident, were distributed by Oracle to its customers in the April 2017 Critical Patch Update, and should have already been applied to customer ...

Exploits

## # This module requires Metasploit: metasploitcom/download # Current source: githubcom/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' => 'Apach ...
#!/usr/bin/python # -*- coding: utf-8 -*- # Just a demo for CVE-2017-9791 import requests def exploit(url, cmd): print("[+] command: %s" % cmd) payload = "%{" payload += "(#dm=@ognlOgnlContext@DEFAULT_MEMBER_ACCESS)" payload += "(#_memberAccess?(#_memberAccess=#dm):" payload += "((#container=#context['comopensymphonyxw ...

Mailing Lists

Apache Struts 23x Showcase remote code execution proof of concept exploit ...

Github Repositories

s2-048 Exp for s2-048, CVE-2017-9791 ______ _______ ____ ___ _ _____ ___ _____ ___ _ / ___\ \ / / ____| |___ \ / _ \/ |___ | / _ \___ / _ \/ | | | \ \ / /| _| _____ __) | | | | | / /___| (_) | / / (_) | | | |___ \ V / | |__|_____/ __/| |_| | | / /_____\__, |/ / \__, | | \____| \_/ |_____| |_____|\___/|_|/_/ /_//_/ /_/|_| poc:

Struts2-048 CVE-2017-9791 Author: DragonEgg def Usage(): print 'check:' print ' python filepy 1111/struts2-showcase/integration/saveGangsteraction' print 'poc:' print ' python filepy 1111/struts2-showcase/integration/saveGangsteraction command' Demo

CVE-2017-9791 Metasploit module for Apache Struts CVE-2017-9791 Remote Code Execution Vulnerability

St2-048 Remote Code Execution Vulnerability Apache Struts 2 possible RCE in the Struts Showcase app in the Struts 1 plugin example in the Struts 23x series strutsapacheorg/docs/s2-048html cwikiapacheorg/confluence/display/WW/S2-048 Use-Age: > python St2-048py set url : xxxxxxxx:port/integration/saveGangsteraction cmd >>:

web-cve-tests The goal of this tool is to send PoC payloads to verify server side attack detection solutions If detected, the server side should return a specifed HTTP status code This tool is not intended to actually exploit the vulnearility or to test for the existance of the vulnerability Usage Basic: /webcvepy -url target-sitecom Specify detected response code

CMS-Hunter 简介 Content Management System Vulnerability Hunter 说明:目前来看,本项目会进行长期维护,有修改的建议或者想法欢迎联系作者。 CMS 漏洞列表 Discuz Discuz_<34_birthprovince_前台任意文件删除 DedeCMS DedeCMS_v57_shops_delivery_存储型XSS DedeCMS_v57_carbuyaction_存储型XSS DedeCMS_v57_友情链接CSRF_GetSh

CMS-Hunter 简介 Content Management System Vulnerability Hunter 说明:目前来看,本项目会进行长期维护,有修改的建议或者想法欢迎联系作者。 CMS 漏洞列表 ThinkPHP ThinkPHP_323-5010_缓存函数设计缺陷 Discuz Discuz_<34_birthprovince_前台任意文件删除 DedeCMS DedeCMS_v57_shops_delivery_存储型XSS DedeCMS_v57_car

CMS-Hunter 简介 Content Management System Vulnerability Hunter 说明:目前来看,本项目会进行长期维护,有修改的建议或者想法欢迎联系作者。 CMS 漏洞列表 Discuz Discuz_<34_birthprovince_前台任意文件删除 DedeCMS DedeCMS_v57_shops_delivery_存储型XSS DedeCMS_v57_carbuyaction_存储型XSS DedeCMS_v57_友情链接CSRF_GetSh

CMS-Hunter 简介 Content Management System Vulnerability Hunter 说明:目前来看,本项目会进行长期维护,有修改的建议或者想法欢迎联系作者。 CMS 漏洞列表 Discuz Discuz_<34_birthprovince_前台任意文件删除 DedeCMS DedeCMS_v57_shops_delivery_存储型XSS DedeCMS_v57_carbuyaction_存储型XSS DedeCMS_v57_友情链接CSRF_GetSh

Etrata CI Vuln Scanner What is it? This is a lightweight python script that will load/read a directory of CVEs and allow you to search on them Usage etrata -n struts -v 2332 >'CVE-2017-9787', >'CVE-2017-9791', >'CVE-2017-9793', >'CVE-2017-9804', >'CVE-2017-9805', >'CVE-2018

Twitter: @Hktalent3135773 see Pro online to 51pwncom, or exploit-poccom penetration tools dependencies Command Description kali linux recommend system node js program runtime javac、java auto generate payload metasploit auto generate payload,and autoexploit gcc auto generate payload tmux auto background send payload, shell

Exploits Containing Self Made Perl Reproducers / PoC Codes This Git Repository Conatains Pesonnal Works That I Do On My free time Donations / Support If you want to support/help me/my projects : BTC : 1N9BgzVVT8ye3UEUXb2p7Pum7RbmEx3byz ETC : 0x789bc32e951ccdaa5702d70fe02e21f596baa085 ETH : 0x789bc32e951ccdaa5702d70fe02e21f596baa085 LTC : LVSPDkX5Dr95cKqQnCMoLgYyzGBdtSsi3y T

Name Description CVE-2015-5531 Directory traversal vulnerability in Elasticsearch before 161 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls CVE-2016-1909 Fortinet FortiAnalyzer before 5012 and 52x before 525; FortiSwitch 33x before 333; FortiCache 30x before 308; and FortiOS 41x before 4111, 42x

Name Description CVE-2015-5531 Directory traversal vulnerability in Elasticsearch before 161 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls CVE-2016-1909 Fortinet FortiAnalyzer before 5012 and 52x before 525; FortiSwitch 33x before 333; FortiCache 30x before 308; and FortiOS 41x before 4111, 42x

Awesome Stars A curated list of my GitHub stars! Generated by starred Contents ASP Arduino Assembly AutoHotkey AutoIt Batchfile BitBake Bro C C# C++ CSS CoffeeScript Dockerfile Emacs Lisp Erlang Game Maker Language Go HTML Haskell Java JavaScript Jupyter Notebook KiCad Kotlin Logos Lua M Makefile Markdown Mask

Awesome CVE PoC A curated list of CVE PoCs Here is a collection about Proof of Concepts of Common Vulnerabilities and Exposures, and you may also want to check out awesome-web-security Please read the contribution guidelines before contributing This repo is full of PoCs for CVEs If you enjoy this awesome list and would like to support it, check out my Patreon page :

Recent Articles

Oracle corrals and patches Struts 2 vulnerabilities
The Register • Richard Chirgwin • 27 Sep 2017

Big Red issues out-of-band patch for Apache and a few other urgent issues

Oracle has stepped outside its usual quarterly security fix cycle to address the latest Apache Struts 2 vulnerability.
Ever since it emerged at the start of September, CVE-2017-9805 has been (in the words of a former Australian prime minister) “a shiver looking for a spine to crawl up”, because so many vendors use Apache to build Web interfaces and bake Struts 2 into their their Web application framework.
Big Red's sprawling product set meant fixes had to be deployed across more ...

Oracle Patches Apache Struts, Reminds Users to Update Equifax Bug
Threatpost • Chris Brook • 26 Sep 2017

Oracle released fixes for a handful of recently patched Apache Struts 2 vulnerabilities, including a critical remote code execution vulnerability (CVE-2017-9805) that could let an attacker take control of an affected system, late last week.
The Apache Software Foundation patched the RCE vulnerability, which affects servers running apps built using the Struts framework and its REST communication plugin, earlier this month.
Scores of Oracle products, roughly two dozen in total, are aff...