A Docker-based environment that builds and runs an Apache Struts 2 web application (version 6.3.0.2) on Tomcat 9.0, designed to demonstrate the CVE-2024-53677 file upload path traversal vulnerability.
The README explicitly states the repository is for CVE-2024-53677, provides a lab setup, and describes the vulnerability. The Dockerfile builds a Struts application with a vulnerable file upload action, and the POM file names the project 'CVE-2024-53677' with a description confirming it is a demo for that CVE.
A Java web application built with Apache Struts 2 (version 6.3.0.2) that provides file upload endpoints. The UploadAction and UploadsAction classes accept file uploads and write them to a directory using the user-supplied filename without sanitization, enabling path traversal. The application is packaged as a WAR and deployed on Tomcat.
A Tomcat 9.0 servlet container that hosts the vulnerable Struts application. The Dockerfile copies the WAR file, a custom tomcat-users.xml with admin credentials, a context.xml, and a modified catalina.sh script into the image. It exposes port 8080.
A temporary build stage based on openjdk:17-jdk-alpine that installs Maven, copies the Struts application source, and runs 'mvn clean package' to produce the WAR file. The resulting artifact is copied to the Tomcat stage.
docker/Dockerfile:1-7
catalina.sh (modified)
Tomcat startup scriptdebugger attachment
A copy of the Tomcat catalina.sh script that includes an additional JAVA_OPTS line to attach an IntelliJ debugger on port 8000, listening on all interfaces. This is a modification from the standard script.
docker/catalina.sh:1-693docker/catalina.sh:234
Python exploit script (CVE-2024-53677.py)
exploit clientproof-of-concept
A Python script referenced in the README that sends crafted file upload requests to the vulnerable application to achieve path traversal. The script itself is not included in the evidence packet, but its usage is described.
README.md:30-48
CVE assessment
How the supplied evidence relates each vulnerability
The POM file explicitly names the project 'CVE-2024-53677' and describes it as a demo for that CVE. The README details the vulnerability and provides a lab setup. The Java source code shows a file upload action that uses the user-supplied filename directly in a File constructor, enabling path traversal, which aligns with the CVE description of flawed file upload logic in Apache Struts.
Execute the Python exploit script against the running container, specifying the target URL and the upload parameter with a path traversal payload (e.g., '../test.jsp').README.md:35-37
Verify the file was written outside the intended upload directory, demonstrating path traversal.README.md:39-48
Safety-review evidence
Behaviors behind the stored safety assessment
No harmful behavior observed
All visible behavior is directed at the contained lab target. The Dockerfile builds and runs a vulnerable Struts application inside a container. The modified catalina.sh adds a debugger port, which is a common development practice and does not indicate hidden compromise. No evidence shows host escape, external connections, persistence, credential theft, or destructive actions beyond the intended vulnerability demonstration.
The Python exploit script (CVE-2024-53677.py) is not included in the evidence packet; its behavior cannot be analyzed.
Two compiled Java class files (UploadAction.class, UploadsAction.class) are present but uninspected; their behavior is assumed to match the provided source code.
The packet does not include a docker-compose.yml or runtime configuration beyond the Dockerfile; port mappings and volume mounts are only described in the README.
Model interpretation
This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.