Apache Struts 2.0.0-2.3.16.1 - Remote Code Execution via Class Parameter Manipulation
Title source: llmExploitation Summary
CVE-2014-0094 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 4 public exploits from researchers including y0d3n, HasegawaTadamitsu.
AI-analyzed exploit summary This repository contains a writeup and setup instructions for attempting to reproduce CVE-2014-0094, a vulnerability in Java classloading. The author notes that while the classLoader is functional, the logs are percent-encoded, preventing successful RCE.
Description
The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method.
Exploits (4)
This repository contains a writeup and setup instructions for attempting to reproduce CVE-2014-0094, a vulnerability in Java classloading. The author notes that while the classLoader is functional, the logs are percent-encoded, preventing successful RCE.
This repository provides a test program and mitigation for CVE-2014-0094, a vulnerability in Apache Struts 1 that allows arbitrary file disclosure and potential remote code execution via manipulation of classLoader properties. The PoC includes a custom SafeResolver to block malicious property access.
This Metasploit module exploits a ClassLoader manipulation vulnerability in Apache Struts 1.x and 2.x, allowing remote code execution via crafted parameters. It includes multiple targets for Java, Linux, and Windows, and supports both direct exploitation and SMB-based payload delivery.
This Metasploit module exploits CVE-2014-0094 in Apache Struts by manipulating the ClassLoader via crafted parameters, allowing remote code execution. It deploys a JSP payload to achieve RCE on vulnerable systems.