Exploitation Summary
EIP tracks 1 public exploit for CVE-2012-0393. PoCs published by SEC Consult.
AI-analyzed exploit summary The exploit demonstrates multiple critical vulnerabilities in Apache Struts2, including remote command execution via ExceptionDelegator, CookieInterceptor, and DebuggingInterceptor, as well as arbitrary file overwrite via ParametersInterceptor. These vulnerabilities arise from OGNL expression injection and improper parameter filtering.
Description
The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.
Exploits (1)
The exploit demonstrates multiple critical vulnerabilities in Apache Struts2, including remote command execution via ExceptionDelegator, CookieInterceptor, and DebuggingInterceptor, as well as arbitrary file overwrite via ParametersInterceptor. These vulnerabilities arise from OGNL expression injection and improper parameter filtering.