Apache Struts S2-067 File Upload Path Traversal RCE

This repository contains a Python exploit script (CVE‑2024‑53677.py) and a README file. The exploit targets CVE-2024-53677, a vulnerability in web applications that allows attackers to bypass file upload restrictions and deploy a JSP webshell. The script crafts a multipart POST request to the /upload.action endpoint, disguising the webshell as a JPEG image, and attempts to write it as '../../SHELL.jsp' on the server. After uploading, it checks if the webshell is accessible at /SHELL.jsp. If successful, the attacker gains a web interface to execute arbitrary system commands on the server. The exploit is operational and provides a working webshell payload. No hardcoded IPs or domains are present; the target URL is supplied via command-line argument. The repository is straightforward, with a single exploit script and a minimal README.

This repository provides a full proof-of-concept and exploitation toolkit for CVE-2024-53677, a critical file upload vulnerability in Apache Struts2 (versions 2.0.0 through 6.3.x before 6.4.0). The repository includes: - Two main Python scripts: 'PoC.py' (a minimal exploit that uploads a JSP webshell and executes arbitrary commands) and 'cve_2024_53677_Tool.py' (a comprehensive tool with a menu-driven interface for detection, exploitation, and post-exploitation, including Docker integration and Selenium support). - A complete vulnerable Struts2 application (Java source, Maven project, and Docker deployment files) to facilitate local testing and demonstration of the exploit. - The exploit works by uploading a malicious JSP webshell to the '/upload.action' endpoint, exploiting a path traversal flaw to place the shell in a web-accessible location (e.g., '../test.jsp'). The attacker can then send HTTP requests to the webshell (e.g., '/test.jsp?action=cmd&cmd=id') to execute arbitrary system commands on the server. - The repository is well-structured for both demonstration and practical exploitation, with clear separation between exploit scripts, vulnerable application code, and deployment resources. This exploit is operational and provides a working webshell payload, but is not part of a larger exploitation framework. It is suitable for both security research and red team use against vulnerable Struts2 deployments.

This repository is a proof-of-concept exploit for CVE-2024-53677, a path traversal and remote code execution vulnerability in Apache Struts. The main exploit logic is implemented in Go (main.go), which automates the process of uploading a malicious JSP webshell (webshell.jsp) to a vulnerable Struts server. The exploit attempts to discover the correct file path for upload using a test file, then uploads the webshell, and finally interacts with it to execute arbitrary commands or perform file operations. The webshell supports command execution, file upload, directory listing, and file deletion via HTTP parameters. The exploit is customizable via command-line flags for target URL, endpoint, payload, and parameters. The repository includes a README with usage instructions, a Go module file, a test file for path discovery, and the JSP webshell payload. The attack vector is network-based, targeting HTTP endpoints exposed by the vulnerable Struts application.

This repository provides an operational exploit for CVE-2024-53677, a critical path traversal and remote code execution vulnerability in Apache Struts. The exploit consists of a Python script (exploit/exploit.py) that automates the attack by uploading a malicious JSP webshell (exploit/webshell.jsp) to a vulnerable Struts server via a manipulated file upload request. The script crafts a WAR archive containing the webshell, abuses path traversal in the upload parameters to place the shell in a web-accessible directory, and then provides an interactive shell interface to execute arbitrary commands on the compromised server. The repository also includes detailed manual exploitation instructions (manual-exploit.md, exploit/manual-exploit.md) and a requirements.txt for dependencies. The main attack vector is network-based, targeting HTTP file upload endpoints. The exploit is operational, providing a working webshell payload and an interactive command execution interface.

This repository provides an operational exploit for CVE-2024-53677. It consists of a Python script (exploit.py) that automates the exploitation process and a JSP web shell (shell.jsp) used as the payload. The exploit works by uploading the shell.jsp file to a vulnerable server via a presumed file upload endpoint (/upload.action). Once uploaded, the shell can be accessed at /uploads/shell.jsp, where it allows the attacker to execute arbitrary system commands on the server by passing them as the 'cmd' parameter in HTTP requests. The Python script provides an interactive shell interface for the attacker, handling both the upload and command execution phases. The repository structure is straightforward: README.md (brief description), exploit.py (main exploit logic), and shell.jsp (payload). The exploit targets web servers that allow arbitrary file uploads and execute uploaded JSP files, and it requires the attacker to know or guess the correct upload and shell access endpoints.

This repository provides a full environment to reproduce and exploit CVE-2024-53677, a remote code execution vulnerability in Apache Struts 2 (version 6.3.0.1 as per the included pom.xml). The structure includes: - A vulnerable Struts 2 web application (Java source, JSPs, and configuration) that exposes a file upload endpoint (/upload.action) susceptible to path traversal, allowing arbitrary file upload outside the intended directory. - A Python exploit script (S2-067.py) that automates uploading a malicious file (such as shell.jsp) to the server using the vulnerable endpoint. The script supports specifying the upload endpoint, file(s) to upload, and the destination path (including traversal sequences like '../'). It verifies upload success and can interact with the uploaded shell for command execution. - A JSP webshell (shell.jsp) that executes system commands provided via the 'cmd' GET parameter, returning output in the HTTP response. - Dockerfile and OpenShift YAML for easy deployment of the vulnerable environment. The exploit's main capability is to achieve remote code execution by uploading a webshell via path traversal in the file upload functionality. The exploit is operational, as it provides a working payload and automation for exploitation. The repository is well-structured for both demonstration and testing of the vulnerability.

This repository contains a Python exploit script (exploit.py) and a README.md for CVE-2024-53677, a remote code execution vulnerability in Apache Struts (S2-067). The exploit targets a vulnerable file upload endpoint, allowing an attacker to upload arbitrary files (such as a JSP webshell) to a specified location on the server, potentially using path traversal. The script then verifies if the file is accessible and can execute arbitrary commands via the uploaded webshell by sending HTTP requests with command parameters. The exploit is operational, requiring the attacker to specify the target URL, upload endpoint, file(s) to upload, and the destination path. The README provides a brief description and references to a video PoC and the original vulnerability. No hardcoded endpoints are present; the script is designed to be used against any target with a vulnerable upload endpoint. The main attack vector is network-based, exploiting HTTP file upload functionality.

This repository provides a working exploit for CVE-2024-53677, a file upload vulnerability in Apache Struts2 (versions 2.0.0 before 6.4.0) that can lead to remote code execution. The main exploit script, CVE-2024-53677.py, is a Python tool that uploads a malicious JSP webshell to a vulnerable Struts2 application's file upload endpoint (e.g., /upload.action). The payload is a JSP file that allows the attacker to execute arbitrary system commands via HTTP requests. The repository includes a full Docker-based lab environment with a vulnerable Struts2 application, supporting files for building and running the environment, and example payloads. The exploit requires the target to be running a vulnerable Struts2 version with the old file upload logic enabled. The attack vector is network-based, targeting accessible HTTP endpoints. The repository is well-structured for both exploitation and educational purposes, with clear documentation and usage instructions.

This repository provides tools for detecting and exploiting CVE-2024-53677, a critical remote code execution vulnerability in Apache Struts (S2-067). The vulnerability allows attackers to perform path traversal and upload arbitrary files, such as web shells, to the server via a vulnerable file upload endpoint. The repository contains two main Python scripts: 1. Check-CVE-2024-53677.py: A non-destructive detection tool that attempts to upload a harmless file using path traversal to check for the vulnerability without causing harm. 2. S2-067.py: An exploit script that uploads a JSP web shell to a user-specified path (using path traversal), then verifies if the shell is accessible and can execute arbitrary commands via the 'cmd' parameter. The exploit targets Apache Struts versions 2.0.0-2.5.33 and 6.0.0-6.3.0.2, requiring the attacker to know the upload endpoint (e.g., /upload.action or /uploads.action). The payload is a JSP web shell, and the attack vector is network-based, exploiting HTTP file upload functionality. The repository is structured with clear separation between detection and exploitation scripts, and includes a README with detailed vulnerability and mitigation information.

This repository contains a proof-of-concept (POC) exploit for CVE-2024-53677, a file upload logic bypass vulnerability in Apache Struts2 (S2-067). The exploit is implemented in Python (s2-067.py) and allows an attacker to upload arbitrary files to a vulnerable Struts2 server by exploiting improper handling of file extensions and filename parameters. The script takes command-line arguments for the target upload URL, the filename to use (which can include path traversal), the file to upload (such as a webshell), and the upload type (single or multiple file upload). The README provides usage instructions and highlights the vulnerability conditions. The main attack vector is network-based, targeting HTTP file upload endpoints. The only fingerprintable endpoint in the repository is the example URL 'http://localhost:28080/uploadFile'. The exploit does not include a payload itself but allows the user to supply any file, typically a JSP webshell, to achieve remote code execution if the server is vulnerable.

This repository provides both a detection script and a working exploit for CVE-2024-53677 (Apache Struts 2 S2-067). The vulnerability allows attackers to exploit flawed file upload logic, enabling path traversal and potentially remote code execution by uploading malicious files (such as JSP webshells) to sensitive locations. - 'Check-CVE-2024-53677.py' is a non-destructive detection tool that tests if a target is vulnerable by attempting to overwrite a file name via crafted multipart form data. It does not exploit the vulnerability but checks for the possibility of path traversal in file uploads. - 's2-067-poc.py' is a full exploit that uploads a JSP webshell to arbitrary paths (using path traversal) via the vulnerable upload endpoint. The script supports uploading multiple files and verifies if the uploaded shell is accessible and can execute commands via the 'cmd' parameter. - The README.md provides background on the vulnerability, affected versions, and remediation advice. The exploit targets Apache Struts 2 installations with exposed file upload endpoints and not using the FileUploadInterceptor. The main attack vector is network-based, requiring HTTP access to the upload endpoint. The payload is a JSP webshell, enabling remote code execution if the exploit succeeds.