T3MP3ST public launch build

bench/cve-hunt/samples/CVE-2017-5638/ground-truth.yaml

@@ -0,0 +1,27 @@
+cve: CVE-2017-5638
+alias: Struts2 Jakarta Content-Type OGNL RCE (S2-045)
+cwe_primary: CWE-917
+cwe_acceptable: [CWE-917, CWE-94, CWE-20, CWE-74, CWE-95]
+target_file: source.java
+vuln_lines: [22, 23, 24, 25, 26, 27, 28]
+severity: critical
+vuln_class: expression_injection
+exploit_pattern_regex: '%\{|#\{|\$\{|ognl'
+must_mention_any:
+  - ognl
+  - content-type
+  - localizedtext
+  - expression injection
+  - attacker controlled
+  - format string
+  - evaluation
+  - findText
+points: 30
+notes: |
+  Vulnerability: req.getContentType() returns attacker-controlled header. It
+  flows into LocalizedTextUtil.findText() which expands ${...}/%{...}/#{...}
+  as OGNL on the default value template, executing arbitrary Java.
+  Hunter MUST identify:
+    1. Content-Type is attacker-controlled (HTTP header source).
+    2. LocalizedTextUtil performs expression evaluation on the message body.
+    3. Result is OGNL injection → arbitrary code execution.