Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com

CVE-2013-2251

Description

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.

POC

Reference

- http://cxsecurity.com/issue/WLB-2014010087

- http://packetstormsecurity.com/files/159629/Apache-Struts-2-Remote-Code-Execution.html

- http://struts.apache.org/release/2.3.x/docs/s2-016.html

- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-struts2

- http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html

- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html

Github

- https://github.com/0day666/Vulnerability-verification

- https://github.com/0xh4di/PayloadsAllTheThings

- https://github.com/20142995/Goby

- https://github.com/20142995/pocsuite3

- https://github.com/3vikram/Application-Vulnerabilities-Payloads

- https://github.com/84KaliPleXon3/Payloads_All_The_Things

- https://github.com/ARPSyndicate/cvemon

- https://github.com/ARPSyndicate/kenzer-templates

- https://github.com/Delishsploits/PayloadsAndMethodology

- https://github.com/Elsfa7-110/kenzer-templates

- https://github.com/Elymaro/Struty

- https://github.com/GuynnR/Payloads

- https://github.com/HimmelAward/Goby_POC

- https://github.com/J1ezds/Vulnerability-Wiki-page

- https://github.com/Maarckz/PayloadParaTudo

- https://github.com/MelanyRoob/Goby

- https://github.com/Muhammd/Awesome-Payloads

- https://github.com/NAYLINNU/PayloadAllTheThings

- https://github.com/Nieuport/PayloadsAllTheThings

- https://github.com/NyxAzrael/Goby_POC

- https://github.com/Ostorlab/KEV

- https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors

- https://github.com/Pav-ksd-pl/PayloadsAllTheThings

- https://github.com/Ra7mo0on/PayloadsAllTheThings

- https://github.com/SexyBeast233/SecBooks

- https://github.com/Threekiii/Awesome-POC

- https://github.com/Threekiii/Vulhub-Reproduce

- https://github.com/TmmmmmR/PoCs

- https://github.com/XPR1M3/Payloads_All_The_Things

- https://github.com/XiaomingX/awesome-poc-for-red-team

- https://github.com/Z0fhack/Goby_POC

- https://github.com/Zero094/Vulnerability-verification

- https://github.com/andrysec/PayloadsAllVulnerability

- https://github.com/anhtu97/PayloadAllEverything

- https://github.com/apkadmin/PayLoadsAll

- https://github.com/bakery312/Vulhub-Reproduce

- https://github.com/brunsu/woodswiki

- https://github.com/chanchalpatra/payload

- https://github.com/eescanilla/Apache-Struts-v3

- https://github.com/fadelmuharam/s2-016

- https://github.com/falocab/PayloadsAllTheThings

- https://github.com/felixsta/hack_tips

- https://github.com/fupinglee/Struts2_Bugs

- https://github.com/gobysec/Goby

- https://github.com/hellochunqiu/PayloadsAllTheThings

- https://github.com/ice0bear14h/struts2scan

- https://github.com/ksw9722/PayloadsAllTheThings

- https://github.com/likekabin/Apache-Struts-v3

- https://github.com/likescam/Apache-Struts-v3

- https://github.com/merlinepedra/nuclei-templates

- https://github.com/merlinepedra25/nuclei-templates

- https://github.com/mrhacker51/ReverseShellCommands

- https://github.com/mycloudlab/network-policy-demo-apps

- https://github.com/nevidimk0/PayloadsAllTheThings

- https://github.com/nth347/CVE-2013-2251

- https://github.com/ozkanbilge/Apache-Struts

- https://github.com/ranjan-prp/PayloadsAllTheThings

- https://github.com/ravijainpro/payloads_xss

- https://github.com/retr0-13/Goby

- https://github.com/s1kr10s/Apache-Struts-v4

- https://github.com/shhimnothere/payloadsallthethings

- https://github.com/sobinge/--1

- https://github.com/sobinge/PayloadsAllTheThings

- https://github.com/sobinge/PayloadsAllThesobinge

- https://github.com/sobinge/nuclei-templates

- https://github.com/superlink996/chunqiuyunjingbachang

- https://github.com/vedkoli/tools

- https://github.com/winterwolf32/PayloadsAllTheThings

- https://github.com/woods-sega/woodswiki

- https://github.com/ynsmroztas/Apache-Struts-V4