CVE-2010-1870
NUCLEIApache Struts 2.0.0-2.1.8.1 - Remote Code Execution via OGNL Context Variable Manipulation
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2010-1870.
PoCs published by Metasploit, Meder Kydyraliev, bannedit, Meder Kydyraliev, including Metasploit module exploits/multi/http/struts_code_exec.
A Nuclei detection template is also available.
AI-analyzed exploit summary This Metasploit module exploits CVE-2010-1870, a remote command execution vulnerability in Apache Struts < 2.2.0. It leverages OGNL expression injection to bypass security restrictions and execute arbitrary commands on Windows or Linux targets.
Description
The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects and bypass the "#" protection mechanism in ParameterInterceptors via the (1) #context, (2) #_memberAccess, (3) #root, (4) #this, (5) #_typeResolver, (6) #_classResolver, (7) #_traceEvaluations, (8) #_lastEvaluation, (9) #_keepLastEvaluation, and possibly other OGNL context variables, a different vulnerability than CVE-2008-6504.
Exploits (3)
This Metasploit module exploits CVE-2010-1870, a remote command execution vulnerability in Apache Struts < 2.2.0. It leverages OGNL expression injection to bypass security restrictions and execute arbitrary commands on Windows or Linux targets.
This exploit leverages OGNL injection in Struts2/XWork to bypass security restrictions and execute arbitrary Java code. It manipulates context variables to enable static method access and disable method execution denial, leading to remote command execution.
This Metasploit module exploits CVE-2010-1870, a remote command execution vulnerability in Apache Struts < 2.2.0 by leveraging OGNL expression injection to bypass security restrictions and execute arbitrary Java code.
Nuclei Templates (1)
http.html:"apache struts" || http.title:"struts2 showcase" || http.html:"struts problem report"
body="struts problem report" || title="struts2 showcase" || body="apache struts"