Over on the GreyNoise Labs Grimoire, Matthew Remacle (Remy) digs into the newly disclosed Apache Struts2 CVE-2023-50164 file upload vulnerability. This weakness allows an attacker to drop a web shell that can be called remotely through a public interface over defined routes.
Keep an eye on our new tag for CVE-2023-40164.
Remy's analysis highlights the following key points:
- Apache Struts2 is an open-source Java web application development framework used in various enterprise-grade applications and business use cases.
- The vulnerability occurs when a multipart form request is used, and the constraints for path normalization are bypassed.
- The attacker can inject a web shell (e.g., shell.jsp) into the file system, which can then be remotely called.
- The exploitation of this vulnerability depends on the specific implementation of Apache Struts2 in a vendor's product and the defined actions' path.
In the coming weeks, GreyNoise and the extended research community are expected to investigate vendor and product-specific implementations leveraging Apache Struts2 to determine the exact path that must be traversed to drop a web shell in those products and call it remotely through a public interface over the defined routes.
This article is a summary of the full, in-depth version on the GreyNoise Labs blog.
Read the full report
Be part of the conversation in our Community Slack group.
Follow us and don’t miss a thing.
.png)
.png)
