CVE-2012-0392
NUCLEIApache Struts < 2.3.1.1 - Remote Code Execution via CookieInterceptor
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2012-0392. PoCs published by SEC Consult. A Nuclei detection template is also available.
AI-analyzed exploit summary The exploit demonstrates multiple critical vulnerabilities in Apache Struts2, including remote command execution via ExceptionDelegator, CookieInterceptor, and DebuggingInterceptor, as well as arbitrary file overwrite via ParametersInterceptor. These vulnerabilities arise from OGNL expression injection and improper parameter filtering.
Description
The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.
Exploits (1)
The exploit demonstrates multiple critical vulnerabilities in Apache Struts2, including remote command execution via ExceptionDelegator, CookieInterceptor, and DebuggingInterceptor, as well as arbitrary file overwrite via ParametersInterceptor. These vulnerabilities arise from OGNL expression injection and improper parameter filtering.
Nuclei Templates (1)
http.html:"apache struts" || http.title:"struts2 showcase" || http.html:"struts problem report"
body="struts problem report" || title="struts2 showcase" || body="apache struts"