cve: CVE-2017-5638
alias: Struts2 Jakarta Content-Type OGNL RCE (S2-045)
cwe_primary: CWE-917
cwe_acceptable: [CWE-917, CWE-94, CWE-20, CWE-74, CWE-95]
target_file: source.java
vuln_lines: [22, 23, 24, 25, 26, 27, 28]
severity: critical
vuln_class: expression_injection
exploit_pattern_regex: '%\{|#\{|\$\{|ognl'
must_mention_any:
  - ognl
  - content-type
  - localizedtext
  - expression injection
  - attacker controlled
  - format string
  - evaluation
  - findText
points: 30
notes: |
  Vulnerability: req.getContentType() returns attacker-controlled header. It
  flows into LocalizedTextUtil.findText() which expands ${...}/%{...}/#{...}
  as OGNL on the default value template, executing arbitrary Java.
  Hunter MUST identify:
    1. Content-Type is attacker-controlled (HTTP header source).
    2. LocalizedTextUtil performs expression evaluation on the message body.
    3. Result is OGNL injection → arbitrary code execution.