T3MP3ST public launch build

bench/cve-hunt/samples/CVE-2017-5638/ground-truth.yaml

@@ -0,0 +1,27 @@
+cve: CVE-2017-5638
+alias: Struts2 Jakarta Content-Type OGNL RCE (S2-045)
+cwe_primary: CWE-917
+cwe_acceptable: [CWE-917, CWE-94, CWE-20, CWE-74, CWE-95]
+target_file: source.java
+vuln_lines: [22, 23, 24, 25, 26, 27, 28]
+severity: critical
+vuln_class: expression_injection
+exploit_pattern_regex: '%\{|#\{|\$\{|ognl'
+must_mention_any:
+  - ognl
+  - content-type
+  - localizedtext
+  - expression injection
+  - attacker controlled
+  - format string
+  - evaluation
+  - findText
+points: 30
+notes: |
+  Vulnerability: req.getContentType() returns attacker-controlled header. It
+  flows into LocalizedTextUtil.findText() which expands ${...}/%{...}/#{...}
+  as OGNL on the default value template, executing arbitrary Java.
+  Hunter MUST identify:
+    1. Content-Type is attacker-controlled (HTTP header source).
+    2. LocalizedTextUtil performs expression evaluation on the message body.
+    3. Result is OGNL injection → arbitrary code execution.

bench/cve-hunt/samples/CVE-2017-5638/source.java

@@ -0,0 +1,40 @@
+// Apache Struts2 Jakarta multipart parser — pre-CVE-2017-5638 (S2-045).
+// The error-message branch evaluates user-controlled Content-Type as an
+// OGNL expression for "helpful" exception formatting. Attacker controls
+// the Content-Type header → controls the OGNL string → RCE.
+
+package org.apache.struts2.dispatcher.multipart;
+
+import com.opensymphony.xwork2.util.LocalizedTextUtil;
+import org.apache.commons.fileupload.FileUploadException;
+
+import javax.servlet.http.HttpServletRequest;
+import java.util.Locale;
+
+public final class JakartaMultiPartRequest {
+
+    public void parse(HttpServletRequest req, String saveDir) throws FileUploadException {
+        try {
+            parseUploadInternal(req, saveDir);
+        } catch (FileUploadException e) {
+            // BUG: attacker-controlled Content-Type flows into LocalizedTextUtil
+            // which evaluates ${...} / %{...} as OGNL — bypassing all
+            // type/security restrictions, running arbitrary Java.
+            String contentType = req.getContentType();
+            String errorMessage = LocalizedTextUtil.findText(
+                getClass(),
+                "struts.messages.upload.error.InvalidContentTypeException",
+                Locale.ENGLISH,
+                "Unable to parse Content-Type " + contentType,
+                new Object[] { contentType }
+            );
+            throw new FileUploadException(errorMessage, e);
+        }
+    }
+
+    private void parseUploadInternal(HttpServletRequest req, String saveDir) throws FileUploadException {
+        // ...real parsing happens here, but invalid Content-Types throw the
+        // FileUploadException caught above.
+        throw new FileUploadException("invalid boundary");
+    }
+}