what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

OSVDB: OSVDB-78276

Apache Struts Developer Mode OGNL Execution

Posted Feb 1, 2014

Authored by juan vazquez, Johannes Dahse, Andreas Nusser, Alvaro | Site metasploit.com

This Metasploit module exploits a remote command execution vulnerability in Apache Struts 2. The problem exists on applications running in developer mode, where the DebuggingInterceptor allows evaluation and execution of OGNL expressions, which allows remote attackers to execute arbitrary Java code. This Metasploit module has been tested successfully in Struts 2.3.16, Tomcat 7 and Ubuntu 10.04.

tags | exploit, java, remote, arbitrary

systems | linux, ubuntu

advisories | CVE-2012-0394, OSVDB-78276

SHA-256 | d95e5ef29a2fce9c476472748fd55d151658b54e2b3321896da72a713f7e54b9

Download | Favorite | View