CVE-2014-0112
EXPLOITEDApache Struts 2.0.0-2.3.16.1 and struts2-core < 2.3.20 - Remote Code Execution via ParametersInterceptor
Title source: llmExploitation Summary
CVE-2014-0112 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 3 public exploits from researchers including Mark Thomas, Przemyslaw Celej, including a Metasploit module exploits/multi/http/struts_code_exec_classloader.
AI-analyzed exploit summary This Metasploit module exploits a ClassLoader manipulation vulnerability in Apache Struts 1.x and 2.x, allowing remote code execution via crafted parameters. It includes multiple targets for Java, Linux, and Windows, and supports both direct exploitation and SMB-based payload delivery.
Description
ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.
Exploits (3)
This Metasploit module exploits a ClassLoader manipulation vulnerability in Apache Struts 1.x and 2.x, allowing remote code execution via crafted parameters. It includes multiple targets for Java, Linux, and Windows, and supports both direct exploitation and SMB-based payload delivery.
This Metasploit module exploits CVE-2014-0112 in Apache Struts by manipulating the ClassLoader via crafted parameters, allowing remote code execution through JSP file creation and execution.
This Metasploit module exploits a ClassLoader manipulation vulnerability in Apache Struts 1.x and 2.x to achieve remote code execution by manipulating the ClassLoader via crafted parameters.