28 lines
939 B
YAML
28 lines
939 B
YAML
cve: CVE-2017-5638
|
|
alias: Struts2 Jakarta Content-Type OGNL RCE (S2-045)
|
|
cwe_primary: CWE-917
|
|
cwe_acceptable: [CWE-917, CWE-94, CWE-20, CWE-74, CWE-95]
|
|
target_file: source.java
|
|
vuln_lines: [22, 23, 24, 25, 26, 27, 28]
|
|
severity: critical
|
|
vuln_class: expression_injection
|
|
exploit_pattern_regex: '%\{|#\{|\$\{|ognl'
|
|
must_mention_any:
|
|
- ognl
|
|
- content-type
|
|
- localizedtext
|
|
- expression injection
|
|
- attacker controlled
|
|
- format string
|
|
- evaluation
|
|
- findText
|
|
points: 30
|
|
notes: |
|
|
Vulnerability: req.getContentType() returns attacker-controlled header. It
|
|
flows into LocalizedTextUtil.findText() which expands ${...}/%{...}/#{...}
|
|
as OGNL on the default value template, executing arbitrary Java.
|
|
Hunter MUST identify:
|
|
1. Content-Type is attacker-controlled (HTTP header source).
|
|
2. LocalizedTextUtil performs expression evaluation on the message body.
|
|
3. Result is OGNL injection → arbitrary code execution.
|