Security Research
CVE-2023-50164 Apache Struts File Upload Path RCE: A Classic Bug in a Classic Framework
Thinking
2024-05-15
4 min read
Research Dossier
#Vulnerability Analysis#Code Audit#Web Security
Apache Struts’ file upload parameter handling allows path manipulation — an attacker uploads a file to an arbitrary location and triggers RCE via OGNL injection.
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a4d4b6d4ade7253d06d61bf923572a6b8c253d117e8b63642be9ad8c68eaee7d4a02592bcdbd3155abcc6a953135deec61ed6729ad92ae056a76758bfc9dbe3a6985cd89376d1c17f0301ad5bb4a1f33d32a0d99c025408ab7e073a5c2afdc442d7f843cea9b9c5e9002116d53f770f9210ad6688c396cc4c042e0674d60fa7db795bf8a4a3edad5e7f2af33b5de23675367574671a01de40172b946d8b8bcdf74835a149b08941017733954355a840e7a09dd6c43143c9b3a57c6f2d92f3bfdb4a60d09902cc8b7d27ef5698e95ddedfc61b3c1dbdd4a5f93f071b8437353912271f08e47d17d08f0684a3a445e300232baa5dbc5f026ee908958328e8ab31228088c53aa8434827e549ddd5baaaaa440b65bc96e31658bea778b183ba9ad840816dbcb25f39749b167e83a8376f3a64329d07aa23ee7f7b7c7f7ece8eb9dfa8dee454e4c56d28dc4216de1aff701caf02d736691e271d638dbe0be451b4948adc2702ce48ff417fe7e38e0c8cc270e682be9d70a9a9ca16f28bbfc5f8b4d0a19ec98937f024ee9fba9cc2e0f6325212fd08cb51143b86adfbcfa5d67517f703fb1d9f0af559967e8173895b61806c4652695053c78dae8065df1c8ee350f465fe398c3d9bc9bad40813d8f4f6955dc12e0ae647614b0e594aebfcc44786a9e281ec7d2d467955f8ae65aca4cc4bcdf46d98e1a66641399d7eada8a4059788457b73acba743929f189649ad02df99a664963b2779acb591fa2ab8aeec2f153fb43718c90b4769b757595030c6d710f83c737220575227603a40ffd5937ac9d45630b16d3daf7492e7bab5029a9a628b29af5f9afc86d608aac7b5cb49fca055351450d6327f0e17c639221b94bd5f9d943ee83214be79f0e892344d3f4034836434014275f093aea31867abf29eb87e2e2a0e5d91ae2a4a54f34e31dcb32a265ca26caff0ae961eca39c1def7bcfc4fa435a24e6ead2c46d07d8606cbcc94dd1c167c576ea841b495853ceecddb45a8d149395c22d00201223bea97c5110b645b1c8c101b2c5a54291efd95bb90497707159c3a1195cbd67ce9b76229cbd3ca5ea7fbac2f0eaf431de13a687be97413c377bcd6eea5aee54002dde1d67162f2f74373809284143c21ce475f30afe4b5e27d6870e065c96391a4f7b86cc6a9766257942f170adcfe5f4fee96d5487b7ca992293e2b79a6e955c3cf6db47559722242c65edff54f44c7e3d29a5a49fccd210c6a3c4eb29e9c7224d3eb9e10754b5fb7d6555e7b45357703443a3e192b00048736958a743988e5c519f453e3187c934029884494e681e3e1134133c8e5a2148e847e120b94265574ef5acb3c2d3b49156d2ed3e70159dc33f4773c271b1989b0fd015e0ede54ce5512cc6cef7fcfd092d1ae2e2a50802b86cfd13b691a38b2a696197606a67f3baf1292419b2052b1586c1721a6805935f6906dea8ed5b2c3f2dd46a66653a577dacbad6f1faafb5579416d302492c889762cc70414eca76a59a6f4a21ca768fa6023e7f70c29d778103190271a2be90b35cec8413cdd6339493758a4cd7507c46cd94128ea932050ecb90aef21f493bfe234dcc2a97417073d2fc2d36ff1e8e37e4a28750340d853998b4134e7797543b7a5ee2bc88fbc2490b720e7b746f874eff74485188f5727c5cea719d5a3e45812cdca66a5e4a0a38201925f669dab3fb03cfbd2dd990147a5074fe5f33c03d816b72c92c85aa454b41da2631b42bba877211169172a77e33228ac45e570d77ac0e7316f3cee9089f75369142138bc0d0762a2c53fc8b65448abc0e1b0b5d597dcc2de12db9bb12d14ebf12d88bf341f26ca3e80cb1115a15b85416eff1afba12fd628005647d2fac812a8684d520861576cceb84d7a24ba4633461221bbbae70460306b2ddd48c72d05bd08f1bc09105700b02390d9da568d94366d829bdb832454ad619790d1deb8d70e4c946ddf852101f085c02cb6111667f64f3e59da50ee3f8d037b2bd07f32a7c0dfef53d3cd474e3af4ffdbafa2c8399867c54b14cdde4b3a894f3af66488f5d17c7f4d78f9046c5e492837c7e6da770f48735624046f83d50847780ddedce9399f2e754132ca3c67afda4b3aed39686357d602001603d9a2f8f324481e855f5fdff9786b5e706f3daf750272c00ccb50a5b458a732441196cc0bd4282fa0c580dfb140aa99b4c938b81766f711233889043275a7595bd7c0e8cc083fdaac96efaebc990aa77b82969cbac769cf7ba4c7bcb414b23e6d34dd4b278992455b6e32538f13bc3608e1f2277ba48d91b3550d7100854bac8a07223b6b7f25c6e22f28f9f662adf8309f2b2e57794fbc19f9a765b51a912fe3bda660ef2383b961547d6e0881cb07688fe7be2c8bdbe74e71eff0c7ee2a1b2ef913f7c587c519ebbdba469e7bd8cce9b0290a31b6de522d5a230696f9c1f6de2c92d43fb17fd0c884049471e42e04148d32ef95732251ce84d171ea5655783a7dd57fbd206b49892c50140bf84fc73d550efe83e20df21a4e30ee5624087aeab05e4cac0973c9324b368df792f58268049b18828c16898e9e8e10fd4ccb2d126919f351b29be62486f81f73c8d9bd6e08e2a134d0cdd2dc485f16e4569c4934ff54602fa5c688ac53062238d4ac7d6ac5fa629f82474ffe9b6a814c50e0a0ae5c4a8fc99de2f5ee1d802a3817250469fa9d2cf4129267ab0052b23ac6b6238b97d4c1a42a0788e25b6988f44a71722a9f6e7d7865aff447203fe3ba8ff3d921138713999710f85afb5afd4b4c701219b05b31a7aa5585b61456f6d4905ce5acdb5aeae30149777fbd404eee5dd140a7cf1c2f1d9de48cbdb1c92d158f742b5b852f32f00c615e3be1f3637000801957ec28a18706e85cd52a991bd58b1ac46c7fd56a0aec4aff82f3f045ccd45f1a9b2651e0c9e420c9448210cf7eb55171d4425095e656b7faee94c89bcc643f148de9b8f503d1aa6199a37e3875a488e2563a0dec15f8bd235ac15aeff07f591919a2b9d0d7501158038e0d2fe4378c44c91f26a9d8f1c6521eb0e725ff012349596e4c5d4c1a6783de8545b9d01e80b9719927e945f504a59671f1b0d1da642220145ea545660fc3eddd002ad9992cda3ea7f0b445f330c16c579dba751a9d87c22830811489230849d52a125b5063e3cbd6756d9ccbe63b4a830eb0187d6a3cfe9a2f8408eeb9edd4511a9dd630666a685492a0c04b1f85a12046da592d0b01dc81e8883061624aff193047d64b21ddfaf42446c1b956f803bf721f2750cc028e3f50374589b2302395226f6f358f075cde868b1c947efc78afe6f03b2bc5031714b0c60740f8db84883d290d1cd702a5d24036d88632dc0e3539d903362d575366577e0f15e152139bf13a12abbdf8d9c5f6a9b2101461787a27b9f7f94d2b0fb37ba2b1e27388213e37982710406b35b496efcc9b17da54bcecba07be888e18e44a31dcd615508a948d5c63f414afc3edcd07c2165ae15cd431b157997a089f105099f5bfc31b3b0a8907e994ff44b647b9cca73a161057e8711fdb08952d4c809236d03b4e2f69b9ae346e08cfcab6cb3f604b51f1ffc50de0e69de2b09f2aed57ff433e8b6eaa3a97ee57ee93e8a4a67d82e502ddb13b1ad1a0dafdb8dfcf7f17902573a97ca6bfea152d16bfb22547bbd3b2dc2434168adfc0b3374b3f7efb475519315efe6a9b25dcc3c9c063075278e0a56f2f343c8f1a5f623d54ac2af9b7bbc2bd8eb1278f05faba805c050a88b4908c9021eba8babcd678d238dcf0cd2c98e9790ae828dc7f48fdb533dc6596157e3602741db6ace8773c9b0a2d340cd0c02b5aa7c3256c88decaf95bd5c7dae3e6309e6ecd50c3a4548bc47e41042e673f5ef817d218ec6f0f4ef329d688b78e9ba22d2e9233cd763c94fdc945e05d0ca2ddb66561c1e81971409d113767ec3916556056a13ccccfcb028ac89b5edc40def44d2da270fd4cd0f2b524aa2a6b4a0bcdc817236d9dc5eb1884d1cca498ebba594258adf4e651cc4e91bbc1d412f91a16529ec11c98a538c9dae5605a81a0dd8a46f6fec4e5ca99468ed8be1a708c3680962092eb229717930aa7bb2551083480aecedc6f3e3d93bbdc32129b2427810e181baf5f90c0ba88350b1c7e23518bdd9622c287e0151fde1a3b499d570e508343e2e33a6f4d2e434a3c7530b34b0b0f75be4da15606977d78f4be87d50b5e81f595ec0acc8f52bf25099f6af433105dcb7066b877ab5d6d00de48bcb15dcde219cf2629493021313f016f4be788f65d8387f9cec8e746c28b841085ca9c124371e2ac8c085380c86bb473b77dc3ef1555cf0cd6ba3fef9f87849efaa71da77a29d1b76fdb0cffc8c2c805a6393580e6cbf81322c3b612ee0fe9032a2dbe66e460c7ce9083546ef7ddc45f64cabeafae682bacf6bb10adb4b784df2ed5e4005bf75d5e8bd9494a45d8525426966dd0f7adacfc8dd8357ce3171ebc74a1c0dd9759183b534434b03135f6ed7ab3d361c503ac31a3b0a6dcd26dfd90889ba580e58819afc4c4b8b119a73e35e5debae1efaedd7fe54bd2870393a9706f2b488ee2f3400bc4227ec28f8fa3ee12fd5bf9a8d642981d641cb33255ddc8e79b4d13081aaf7744bc42e6a0c1325fbbd8c9eb25b0b8e35b68c8a5094dcd3c4e9408b0cb28de9eb364ebc75c7e272d894f7f2344e6d9db578cb51cc3bac75875f0c15621b33dc8fde102e9b47cf9cf6bb1b6cf6a97cd8c812408d24c1c7e5b7a4febd7da0be2e6b5c799b5cfd01143dce250b95a7a51f58f0388af6f94e61faa0a47e95f7f1162384b27214e26f1fb972666ce3328c00610773b3f94f2d423abe24bb32841709aef0faba4619a10fc7a7e09769ca19bbe997172de71f4867f8b03429391c5d17e57a4959d79b5d6412c47590630ba91fede4e78072e3ab88320085fd6f3fbcfbb64c17d4ed6eed540465c1071ac88138349345342d03c8d2408ecc372bdad7f6ff13ffebdeed5e2690db7d702f4044b413d9ce93168bdfae978af133316cb30d4e48108cbfe3b15cae1e903d64ada3e77a9e37c650e27d709827e7b1621d1a9253d99b5ecefdee76158b5963efc16e1975bd50ddf0eef978e6642b7533dd3e316e26ef0b9cbfa9e1e1ae1c164f5af3244da3b92f2ca3810829304047c9395488d8c7c0c485e604a22277f6a02a296dbc9b215eafb110ba441175475d9cedc0e9ae865f9973134abea63e78ab6591f86841a0b30f7c9cfdbbff9dffa2198e6c8281214bd65b2c8b2f806768265849f349f4b0fae0df32bfa22510c8479b738e3d3f798b860dec8a0cca56025eea37dd3ecc5bee0fe85ecf9f8d67891fb528f516d9df2064c360904c67ae6ce49bc7508724f1478235f863422ebb932131d152787da88bd53d8255645f38d1d5bcf51d6f49274e4655b12f6a04e22e6a7e16e715486e9580fefcc513c18bfb20c3753ba92d9666a7e425b424346696ab5f9c4f7b73c6bcd154e3c8507a0af80f3b12c1b0a8923356a7d9bf3d6f61fd51b41d2352fcd86563b1031e195d462bbd3f3dca8c3d578e52521933226bb6f82ff861ed5ae5cca507ba01cc983dab9db3d0364fb95ead4075d07f3d7506d9b797a5001e4957e9cb5cf43cf2f92a773580ffe6d3e519cd51b5ec90896d374217c225ce05786946d734f7380c427c1c069a2d754ce697c5559c8ea7b5ac3c7b3077bd7c5be716b7a61a5d92c83359f64f459b16497b0440f5c7c1f2e4608c873d8709ca61e6b85ccf4b1a878ca02b6227a2b4a3288c93fe87ab12202d65d74707f3e18f23deddeaf99e5e4fdf532fc9a22745af24b5fee40286417f739a699b480805f75321286d70c6a389473757977ba68e901ff804e9650f5e5699d01c55d329924307a5f3c42ff53ea8308f5b59ee8d9df793146ea2168f45cc62eba7cc7e7ce519a515b52e8c3f5cd4d0b97233beec0cf1f650ecbdc3acdca3a92a2cbc77ac1ba7796007ffb9e387b8efc849217ba1c363b85b0d271ee53cb494ec0bce4845c16e28e82da57293d5747a79c52f2c3af7906e02fd8d48102fc08b0c8bcd53d941d4474212f85ed51881615bc6fcf9720cef23bfb9fe6f9d3a28ee721bc4bcdecaeb0d84dd02e2d2d5b6a0238c7dc93d30b8c7286fd5b7d43eba1e13e3d35ff9b17e81a290a32ed8ae20597d0408c6155bcab1a323d0f1cc9718c9a10fe41f5002b528ef61f1b7596f7c428cd958db5399d0c9a0009139174097db29e002c035a88d62caad18759bfd30a0f25e8c3f3e1de076209d7231702329c063a0115e52faad081e2581e79d393adc6af75dc4dc184081ac9c612affbac9c05a21210cb6149d1c7648aa77d155a9ba4313539d4e97f6959018542b53b768129c37666da395420c31cdc35fc5572eff468893892499e052d255348bcbbfd953e21763a91d0e642d76de5c1f20665424bd361bf2f958931ddaaa18e3bc8d702910bf32bbfd2cbed2b84dedf41c496434ec18639dde7392ac0bce4b48ce014b0851e589c7575520b80b7a2c3926d8acb5d542ea8121ac2d5ff07c2871098312987fdce9ac3b730493ad089a58470597aaef4bdf1f8e6b96c3733ed1e90e2b29164e36b076f25824d72fdc13f56cff06be42c9163ff8dc659393d041da36d0bec6d5d2338baa356ced64e59de15af8bb3308ada4d5201b226771c33d1cc8dd5197bf3cf6ca73a5d22cd0944405ffa051ef3ddbb59f621b4fb18e5fd8cf54035d5756fcaf4106d0c8ff6389095550744624e1ff2e428931c101ad823608c6e5a935576ac6aef91bd4d9dc39d23d8b0f873c2bc6b6fa9b2c9fe66b81c98b009eb5f4e198f3832fdae52ddb73399e29119277dbba8cae077cd3dc2c55c5bf000a16ed8983a3d58ca4c85619c2d343b1adbbea592b87106b3bd81a28f7b1a1f1839c36b02fc133b9dff9a4f00427adb08c948422991a89e52a1cae54e74e62458d454b7770312d0a944b7abcfb79964215934eaf1e0626272b17ff97384436b13c6047859c4c4b993acdcece9f61c6aa27b04fc74e469d4e7d2997a612df31f3d939f9d614b287d7f28716377257f6918c49c6acb39ff8e10bc9e4e01378c483603131b733f85f6db3aba7387c130085cb672da650e48845af02c4e96ed1884e56ac36f15d08c66dd490cbbf95ad0c65c05f2371d193de419778405853dab12f2b3fc5e556f786683cbc4a6c7fe8759b7c38d8ad3d767c73f44b14c99640e0ca833acdf58990e84f2c601a522bc0169b415a9baae11e8bd441b4a8100ff797c3cd64ecd8c2c80c1763a06f6adcd6da05dc5fd9174b6df8018bb75d99301a86782084e826ca7895e146b63f5d9dcff57c7425baa4ddf3306d4da38cc669bd0d168289c2a5057d37dd0b813c0d5de653a56f0fc2627d65ffafe6ab98245dc950bc54bbc98bda50c7ac72915bedafce65793820642df94d163da0298ceb6a2da7a317aab3046b8ac1a7c56e9b9d1d2cfab1a9c41df18563320b6fccb906070418ba576768b950ad86873d7290ffd5f7f5dd940836502895eeac62bff33e53c175f3e89177312a4802f8f32e5d5c3b6423c00f3b1a46c0adde326a6ba868a7e8e780f3cb384bd1c1c1d535dca285f4c93c1cd4d96d9ea57b69d2ac97a68ba38ff85cda1a3ea9f94ec513d0d4773b7081c8db1306284cb76503c204fd5aa1e4cd252ae25f1b69632978b6d1736946b152da88259f9085e93e7e5ce56d3d405544a1f44e2886fa0ef60cf3f9f86151b78e1c3f49bc2157220e804408215d284fab25d16e16272018a0e3be9f166d1b6970ebae46976e972613e2f2cb8eff453254a2f700c205c00e26619eda2409aaf9f39946855dc7299938fedb40ef46f225d8edc8f91b6fe39b57ebdedd0eb286a45347df4d3c620cddfe05ef85ec27df384e45e5311c640752816e9aaeccaf7e07629e198472dfc3be858b3fcc82f7942b46161eb09aa25cf67d62d3bcce5b377ca12554005914fd3b022376ddbd1c209ebab32803804e818f62bd29d4b701a3efa11af71941fe17bb88f9380b1c4da7c3a75d2a8bb7ea5d7e6b4784c5826b1a3ff58ec1adeef2a9ecd889bb0cbf8c3bb3af209797abecc95e7156a6c0d9f74b8acbcbea0bb01fc4b7d3bfa4449841eb2dc5868e60a6e93ea814af06d87f2d9c515d3120235483ea044acfe1ed83035faadfa08d715e5f623b228a6ef09c1f5e993caf5e1db7d1c578dd681b1a44c992738dd317b89a8c3e99135e629a078b7e5d5b813b776d795c6da12e0f1c33eebec06e6866e4827095ecc1731e7dcd524e9e52d42b08c31ab53bb4d19bf7dfc056662abb1a83699434c0c331ff9078db14e04e50ef3daaba5759e80abd0b9c17842c76f3b22f73a97a2a961e9ab5d32ed