CVE-2013-2115
HIGHApache Struts 2.0.0-2.3.14.1 - Remote Code Execution via OGNL Injection in URL/A Tag
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2013-2115.
PoCs published by Metasploit, Coverity security Research Laboratory, NSFOCUS Security Team, Eric Kobrin, Douglas Rodrigues, including Metasploit module exploits/multi/http/struts_include_params.
AI-analyzed exploit summary This Metasploit module exploits a remote code execution vulnerability in Apache Struts versions < 2.3.14.2 by injecting arbitrary OGNL code into the stack, bypassing Struts and OGNL library protections. It supports multiple platforms (Windows, Linux, Java) and uses HTTP GET or POST requests to upload and execute payloads.
Description
Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.
Exploits (2)
This Metasploit module exploits a remote code execution vulnerability in Apache Struts versions < 2.3.14.2 by injecting arbitrary OGNL code into the stack, bypassing Struts and OGNL library protections. It supports multiple platforms (Windows, Linux, Java) and uses HTTP GET or POST requests to upload and execute payloads.
This Metasploit module exploits a remote code execution vulnerability in Apache Struts versions < 2.3.14.2 by injecting arbitrary OGNL code into the stack, bypassing Struts and OGNL library protections. It supports multiple platforms (Windows, Linux, Java) and uses HTTP GET or POST requests to upload and execute payloads.
References (4)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H