Apache Struts File Upload Parameter Path Traversal RCE

This repository contains a Python exploit script (exploit.py) targeting CVE-2023-50164, a critical path traversal vulnerability in Apache Struts (versions 2.0.0–2.5.32 and 6.0.0–6.3.0.1). The exploit allows an attacker to upload a webshell to the server by abusing a vulnerable file upload endpoint (such as /upload.action), leading to remote command execution (RCE). The script provides a menu-driven interface for version detection (including Docker-based checks), vulnerability checking, webshell upload, and webshell interaction (optionally via Selenium for browser automation). The only other file is a minimal README.md. The exploit requires the attacker to specify the target upload URL and optionally a Docker container name for local testing. The main attack vector is network-based, targeting HTTP endpoints. The script logs its activity to a local file (struts_exploit.log). No hardcoded credentials or IPs are present, but the default example endpoint is http://localhost:8080/upload.action. The exploit is operational, providing a working webshell payload and interactive exploitation features.

This repository provides a full proof-of-concept (PoC) exploit for CVE-2023-50164, a critical remote code execution vulnerability in Apache Struts related to unsafe file upload handling. The structure includes: - `exploit/exploit.py`: The main exploit script, written in Python, which crafts and uploads a malicious WAR file containing a JSP webshell to a vulnerable Struts application's file upload endpoint. It then provides an interactive shell to execute arbitrary commands via the webshell. - `exploit/webshell.jsp`: A simple JSP webshell that executes system commands received via the 'cmd' HTTP GET parameter. - `exploit/requirements.txt`: Python dependencies for the exploit script. - `struts-app/`: A demo vulnerable Struts application, including Java source code (`Upload.java`), configuration files (`struts.xml`, `web.xml`), and JSP pages for upload, success, and error handling. This app is used to demonstrate the vulnerability in a controlled environment. - `Vagrantfile`: Automates the setup of a vulnerable environment using Vagrant, provisioning a Debian VM with Tomcat, Maven, and the vulnerable Struts app. The exploit's main capability is to achieve remote code execution by exploiting the file upload vulnerability to deploy a webshell. The exploit is operational and provides an interactive shell if successful. The repository is intended for educational and testing purposes only, as stated in the README.

This repository contains a functional exploit for CVE-2023-50164, a path traversal vulnerability in Apache Struts 2's file upload mechanism. The exploit is implemented in Python and consists of two main scripts: 'exploit.py' (the main orchestrator) and 'upload.py' (handles the file upload and verification). The exploit works by crafting a malicious file upload request to the '/upload.action' endpoint, using directory traversal in the filename to place a JSP web shell ('web_shell.jsp') in a web-accessible directory. The payload is a JSP web shell that allows remote command execution via the 'cmd' parameter. The exploit targets a default URL ('http://strutted.htb/'), but this can be modified. The repository also includes a 'requirements.txt' for dependencies and a detailed README.md explaining the vulnerability, exploitation steps, and ethical usage. The exploit is operational and provides a working web shell if the target is vulnerable and unpatched.

This repository is a Proof of Concept (PoC) for CVE-2023-50164, a path traversal vulnerability in Apache Struts (struts2-core 6.3.0.1) that can lead to remote code execution (RCE) via malicious file uploads. The project is a Maven-based Java web application with two main upload endpoints: one vulnerable (Upload.java) and one patched (UploadNoVuln.java). The vulnerable endpoint allows an attacker to upload a file to an arbitrary location by manipulating the 'uploadFileName' parameter, enabling the placement of a JSP webshell (e.g., 'rogue.jsp') in the web root. The exploit is demonstrated by uploading 'payload/rogue.jsp' and accessing it via the web server, confirming code execution. The repository includes all necessary configuration and documentation to run the PoC with or without the vulnerability, and clearly distinguishes between the vulnerable and fixed behaviors. The main attack vector is network-based, targeting the HTTP file upload endpoint. The PoC does not include a weaponized payload but demonstrates the exploitability of the vulnerability.

This repository is a Proof-of-Concept (PoC) exploit for CVE-2023-50164, a file path traversal vulnerability in Apache Struts2. The repository contains a vulnerable Java web application (StrutsUploadApp) built with Maven and Struts2 (version 6.3.0.1), along with Docker files for easy deployment. The main exploit script, exploit.py, is written in Python and automates the exploitation process by uploading an arbitrary file (such as a webshell) to the server using a crafted POST request to the /upload.action endpoint. The exploit leverages path traversal in the file upload parameter to place the file in a web-accessible directory (e.g., webapps/ROOT/), enabling remote access or code execution. The repository structure includes the vulnerable app's source code, configuration files, JSP pages for the web interface, and the exploit script. The exploit is operational as a PoC and demonstrates the risk of arbitrary file upload and potential remote code execution on unpatched Struts2 installations.

This repository is a Go-based proof-of-concept (PoC) exploit for CVE-2023-50164, a vulnerability affecting Apache Struts and potentially other Java servlet containers that allow unsafe file upload handling. The exploit automates the process of uploading an arbitrary file (such as a web shell) to a target server by compressing the file into a WAR archive and sending it to a user-specified upload endpoint. The tool supports path traversal to reach web-accessible directories and can adapt to Windows or Unix-like file paths. The main entry point is 'main.go', which orchestrates the payload creation, upload, and verification steps. The exploit requires the attacker to provide the upload endpoint URL, the file to upload, and the target directory path. The README provides detailed usage instructions and example commands. The codebase is modular, with separate packages for payload construction, WAR file generation, and utility functions. No hardcoded endpoints are present; all targets are user-supplied at runtime. The exploit is a functional PoC and does not include weaponized or framework-level automation.

This repository provides a full proof-of-concept (PoC) exploit for CVE-2023-50164, a critical path traversal and remote code execution vulnerability in Apache Struts. The structure includes: - `exploit/` directory: Contains the main exploit script (`exploit.py`), a requirements file, and a JSP webshell. The Python script automates the exploitation process by uploading a malicious WAR file (containing the webshell) to a vulnerable Struts application's file upload endpoint. After successful upload, it provides an interactive shell to the attacker via the webshell. - `struts-app/` directory: Contains a demo vulnerable Struts application, including Java source code, JSP pages, and configuration files. This app is used to demonstrate the exploit in a controlled environment. - `Vagrantfile`: Automates the setup of a test environment with Tomcat and the vulnerable app, making it easy to reproduce the exploit. The exploit works by abusing the file upload functionality to perform path traversal, allowing the attacker to write a WAR file to the Tomcat webapps directory. Once deployed, the WAR exposes a JSP webshell accessible over HTTP, enabling arbitrary command execution on the server. The repository is well-structured for both demonstration and testing, and the exploit is operational, providing a working payload and interactive shell. The main attack vector is network-based, targeting exposed file upload endpoints on vulnerable Struts installations.

This repository is a Proof-of-Concept (PoC) exploit for CVE-2023-50164, a path traversal to remote code execution vulnerability in Apache Struts2. The repository contains a vulnerable Struts2 web application (Java, JSP) and an exploit script. The exploit works by packaging a malicious JSP webshell into a WAR file and uploading it to the vulnerable application via a crafted HTTP POST request to the '/upload-1.0.0/upload.action' endpoint. Once uploaded, the webshell is accessible at '/webshell/webshell.jsp', allowing the attacker to execute arbitrary system commands via the 'cmd' parameter. The repository includes Docker support for easy setup of the vulnerable environment. The main exploit logic is in 'exploit/exploit.sh' (for uploading the webshell) and 'exploit/webshell.jsp' (the webshell itself). The structure is typical for a PoC: it demonstrates the vulnerability and provides a working exploit, but does not include advanced features or automation beyond the basic attack flow.