Struts2 S2-066 File Upload Path Traversal
- Product
- Apache Struts 2
- CVE
- CVE-2023-50164
- Disclosed
- 2023-12-07
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- no
- Affected
- 2.0.0 - 2.3.37 (EOL), 2.5.0 - 2.5.32, 6.0.0 - 6.3.0.1
- Fixed
- 2.5.33, 6.3.0.2
Summary
Struts file-upload parameter handling is case-sensitive in one place and case-insensitive in another, letting an attacker overwrite the sanitized upload filename with a path-traversal value. On apps exposing a file-upload action this lets a JSP webshell be written into the web root.
Root cause
HttpParameters treated parameter names case-sensitively, so a capitalised 'Upload' field and a separate 'uploadFileName' parameter could both be bound; the second, attacker-supplied filename (e.g. ../shell.jsp) overrides the one FileUploadInterceptor sanitized. The action then saves the file to a traversed location.
Impact
Arbitrary file write leading to RCE on applications that implement a Struts file-upload action.
Public PoC
POST /index.action HTTP/1.1
Host: localhost:8080
Content-Type: multipart/form-data; boundary=----X
------X
Content-Disposition: form-data; name="File"; filename="shell.jsp"
Content-Type: text/plain
<% out.println("hello world"); %>
------X
Content-Disposition: form-data; name="fileFileName"
../shell.jsp
------X--Source: vulhub / struts2/s2-066
Detection
Look for multipart requests with both 'File'/'file' fields and '*FileName' parameters containing '../'. Inventory struts2-core versions.
Mitigation
Upgrade to 2.5.33 or 6.3.0.2+ and migrate to the new Action File Upload mechanism (S2-067 / CVE-2024-53677 affects the legacy interceptor).