Description
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Struts | 2.3 to 2.3.34, 2.5 to 2.5.16 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Apache Struts 2 Namespace Redirect OGNL Injection
exploit/multi/http/struts2_namespace_ognl
Exploit-DB 3
- Apache Struts 2 - Namespace Redirect OGNL Injection (Metasploit) EDB-45367 · remote · Sep 10, 2018 · verified
- Apache Struts 2.3 < 2.3.34 / 2.5 < 2.5.16 - Remote Code Execution (1) EDB-45260 · remote · Aug 26, 2018
- Apache Struts 2.3 < 2.3.34 / 2.5 < 2.5.16 - Remote Code Execution (2) EDB-45262 · remote · Aug 25, 2018
GitHub 17 repositories · most starred shown
-
mazen160/struts-pwn_CVE-2018-11776 ★ 304 · Aug 25, 2018
An exploit for Apache Struts CVE-2018-11776
-
hook-s3c/CVE-2018-11776-Python-PoC ★ 123 · Aug 24, 2018
Working Python test and PoC for CVE-2018-11776, includes Docker lab
-
649/Apache-Struts-Shodan-Exploit ★ 56 · Aug 29, 2018
This tool takes advantage of CVE-2018-11776 and Shodan to perform mass exploitation of verified and vulnerable Apache Struts servers.
-
Ekultek/Strutter ★ 21 · Aug 27, 2018
Proof of Concept for CVE-2018-11776
-
arlyone/Apache-Struts-0Day-Exploit ★ 16 · Oct 10, 2019
Critical Remote Code Execution Vulnerability (CVE-2018-11776) Found in Apache Struts.
-
brianwrf/S2-057-CVE-2018-11776 ★ 16 · Aug 28, 2018
A simple exploit for Apache Struts RCE S2-057 (CVE-2018-11776)
-
xfox64x/CVE-2018-11776 ★ 15 · Aug 23, 2018
Creating a vulnerable environment and the PoC
-
bhdresh/CVE-2018-11776 ★ 12 · Aug 25, 2018
Vulnerable docker container for CVE-2018-11776
-
jiguangsdf/CVE-2018-11776 ★ 10 · Aug 24, 2018
CVE-2018-11776(S2-057) EXPLOIT CODE
-
knqyf263/CVE-2018-11776 ★ 4 · Aug 25, 2018
Environment for CVE-2018-11776 / S2-057 (Apache Struts 2)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Apache Struts2 S2-057 - Remote Code Execution http/cves/2018/CVE-2018-11776.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.struts:struts2-core | >= 2.0.4, < 2.3.35 | 2.3.35 | GHSA-cr6j-3jp9-rw65 |
| Maven | org.apache.struts:struts2-core | >= 2.5, < 2.5.17 | 2.5.17 | GHSA-cr6j-3jp9-rw65 |
References
- 1041888 vdb-entry
- 45367 exploit
- 45262 exploit
- 105125 vdb-entry
- 1041547 vdb-entry
- 45260 exploit
- [announce] 20200131 Apache Software Foundation Security Report: 2019 mailing-list
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://security.netapp.com/advisory/ntap-20181018-0002/
- https://cwiki.apache.org/confluence/display/WW/S2-057
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0012
- http://www.oracle.com/technetwork/security-advisory/alert-cve-2018-11776-5072787.html
- https://lgtm.com/blog/apache_struts_CVE-2018-11776
- https://security.netapp.com/advisory/ntap-20180822-0001/
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-005.txt
- https://github.com/hook-s3c/CVE-2018-11776-Python-PoC
- http://packetstormsecurity.com/files/172830/Apache-Struts-Remote-Code-Execution.html