CVE-2017-5638 Exploit Metadata

PoC files

14 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-07

Technical assessment

A detailed technical writeup analyzing CVE-2017-5638 (S2-045) in Apache Struts 2.3.30. It documents the process of identifying the vulnerable Jakarta multipart parser, confirming the affected version, verifying the error handling flow, and constructing an OGNL injection payload for remote code execution. The artifact includes a complete curl command demonstrating exploitation and discusses post-exploitation and remediation, but the primary content is explanatory analysis rather than standalone exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a single README.md file that documents a step-by-step analysis and exploitation of CVE-2017-5638 (Apache Struts2 OGNL Injection). The text describes reconnaissance, version identification, payload construction, and post-exploitation steps, including a curl command that achieves RCE. No backdoor, deceptive payload, or concealed operator-directed harm targeting the person running the PoC is present. The content is a standard vulnerability write-up and does not contain instructions or code that would harm the reviewer.

ClassificationWriteup

Model confidence95%

AuthenticationNot required

Languagesmarkdownbash

Target softwareApache Struts 2

Attack typesognl injectionremote code execution

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a Markdown document that provides a step-by-step technical analysis of CVE-2017-5638, including environment reconnaissance, version identification, and behavioral verification. While it contains a complete exploit payload in a curl command, the document's primary purpose is to explain the vulnerability and the exploitation process, making it a writeup.

README.md:1-218

Requirements

Target must run Apache Struts 2.3.30 with Jakarta multipart parser and an upload endpoint.README.md:51-69

Observed behavior

Sends a crafted HTTP POST request with a malicious OGNL payload in the Content-Type header to achieve remote code execution.README.md:152-155
Executes the 'id' command on the target server and returns the output, confirming root-level access.README.md:157-159

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Payload: curl command with OGNL payload in Content-Type header targeting /doUpload.actionThe README provides a complete curl command (lines 152-155) that exploits CVE-2017-5638 against a vulnerable Struts2 instance. This is the documented exploit, not a backdoor.README.md:152-155
Target Endpoint: http://192.168.3.137:8001/doUpload.actionThe exploit targets a local IP address, consistent with a lab environment. No external or attacker-controlled infrastructure is referenced.README.md:152

Review boundaries

What the analysis did not establish

Only the README.md text file is included; 13 non-text media files (images) are omitted, so visual evidence referenced in the writeup is not available for review.
The artifact is a static document; no dynamic execution or verification of the described exploit was performed.
Only the README.md file was provided as text evidence; 13 non-text media files (images) were flagged as metadata-only and not analyzed. These images are referenced in the write-up but their content is not available for review.
The analysis scope confirms no executable source code was identified in the repository, so no backdoor could be hidden in code outside this file.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

CVE-2017-5638