安全研究
CVE-2023-50164 Apache Struts 文件上传路径穿越到 RCE：经典框架的老问题
Thinking
2023-12-15
2 分钟阅读
研究档案
#漏洞分析#代码审计#Web安全
Apache Struts 在 ActionSupport 处理文件上传时未严格校验上传路径，攻击者改一个 multipart 字段名，就能把 webshell 直接投到 Tomcat webapps 目录里——这是 Struts 在 2023 年又一次被『路径穿越到 RCE』的老戏码击中。
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a47062292625ea7240d146fb061f3975a6253d117e97272d7df5aa897fb9fe2c09034f658aae2645a68076992d7d9de07ae63e2fac88f85e475412988dfbc9247680cf8b2c6c0cc15c80dc1c718fe5b353dbcedcb3244293acf237b79cfb861f3e32ca72b5c5da1cc1584a22d858a85edf8f5bbe279f952d45b629a282bca849a092f6d70a588195baaff372bb0b86c0d6b28582ff04c97691b60fd303281d15fe029ccb67bf7f95c8fdbd9cb5ba19d0978201a6d4d99819e7b5491617a6dd323906ee897cd3007d25f625a60c2114ace375b2d0c6c8595ec7f8e760b7fddd45b4c11b08973c4619f162027e10d396f37d81a1c5c5fd627544659dfe480e63cea9a25cdb7c71fd068bd35117d7495a25ef43d428b6fe8a737cbf404b6bec80b02e3f97ce6b7e58ab22ae33bd01867a1abdad23bd22f5173f521473112ca3acfb94e4475b1844d3cff71258bcaf45dc226bfe8da04c34ac239f7f231becbeb03afaed3118cad0c81844c7c528364489a9b7f63a4cad2e7167fdb83602879569404abc9856f1a0860322ffa0512ee9d3830feabe954247b420557313d985a3fedadefeecc3b879da49c8465684ec6a1caa6a53fc1f526be1e17311de93d5697b5e65a9aa9cf02d784751c036925c7a339d50a5e266686bf0ec8db7ef954e656f82641a959fad7a970dcfb51f8b1e9bb09b5e9699132a750ccb96f39dc72f182ac71fba7484f31ad7cf579b51a91fd886ba5783292170bbf6aaa336a2aefa224b70e37c44c6078fea1081e5f6f74b7dc46dba626b6657421d6e285bff93da368cbd4235a82c3ae37c8fe0e2e5139a99738529f717f8d5a7ee4de2dcaad758eabd487844629d737a0f1e834a23198da64dd98660bc6e46e03cabadd63a16701e7edd2dbfe9f3b13b573e73b3e57607b6ab7f2b2414678bb0741909e307a1743eeebdca66f405283d529223bd1a0b252560b7bb20a34827fc705bce74c79d2d295e0edd8da5e14db44fb496c222b0829606e98586a5f473d95f402632f9c9d1594036114f8410072e551c355cfa93e495586142911996b2790019892f1bad8e89ce9514c4abed7d5aaf8b9276e0bd907af9e749b87a4a6f1cabe55114d4f6d97561f6eb473686d19c1f2a37c8561162d2e7a6e529f2d32eeb18b45842393bbf3c9f23654d89270042daf84e3de890ce566539e0d969342171a466f5279a2eb5524e214d42961f8db4021d9ce2c99f5f55d7e31960293557b19fc42325dff79502274947eadd5b583e01393b2473054c07514156c67bd0de316bc7b6d64ce753ed0a6b8e123a995fd1f79ce9e74a5c7cd3f5fb0b86827e5e5dc2a6f0b063ac456e0b1b7e12623585ab7d1c8e33a42573645e569ef9f8515c15d1549d0952d066ee77cfce9dc0ad7c6a408c70dbaa9f6f2c546cb0a4d4087304f1333eb41092ca58f6c773e7aadde93048afa13b4da5146c456c60b0c459a96210ff5d1c7f34ab8730fb203545317123111561edb04d93fc0a2ab49620162f9a4fb67ae3d5622ce0a07ac4bfc950a9c5c433b8d0187ceaf964eb391e721ae581611d92ab2183ac2475f8f5243bf73aa61a5a3141d2552b4f795a02202b87923bfda1c36006ee82e2c206860252befc0b96e09e48307ae34a6950a46c67b77f32c25fa2690b93c05280542b874953ab9aa6a9595c968f67bd79754ba651b95d7899ab3fa32ff2c8cdd81941ad49d94b72fbf80657a1359e901434845c9b67bd9aed6b0da7aadeb3f9356fb13039bd4bfc6dcb364d3cfdfef8191b353c1c72103f38b1520760a0df76d5bd15ca11076759755f6f5e4231f48298f5290db1926bd1bf705e72977385d10258b11f80563af904fbbe7c8665045659d2f5ce51a92b57580e6a1b62ceae002d29e02565583821bbbae7047c647769d752986212e95ca3ba16144501ee69cfd2c64789cb3964cd90d8d57f9c72bc1d6037151b7f1243dc7ec1af2101eccdd32cf55d4b70ec043c48d342f82dc2426163cd7527b08edba35fd9d5005d18f8e5c6a5a28034ceb272c1d2717783a53987bb4620b2f7836a675f2bb8177b021f68b126158f3111082c0c7309e963319ab9a29f6b4b5bc070ba8889b352fbf5471bd6d57fab91c4814381ca9dbd163e37a1651d44df1e01d12dc9d45e704b19aff2d48944f3109f6b4acf45f7def96504c61faef4404963053aa8253e54219117edec32fda9c54293b1df31808847093a49f8909c8fa9daaebe8c04bb7283da80340f9a5adc044d68525d94125a345aa2f60368981a567d6d9800bd62937e1ba5a25a0e7f44cfbaddc05dae320b96ea9bc7b9ad4c3b90dd7508ec7709ed0db3e7dfa08729b86136804443df39e9a3b504a077c6b423182e2207ca833374cbaee82cc897a6016ae1f2d6e7380d3cb652ed8d9acf0cfcf3b0079f77c78bfad6684874fadc4c591b740bc4aec3e3837089da23c93a838dc556d739e97c0f099e3fe09870344ed19846b01dd489a4bcae42f97cfa324b8270006a4eb61bc5232146bb9ff40beb4e0d3fee50245078f7b30d6a9b3e3d932f176ad4a78fa7db32509705d64da8e2657005cf7adc33f15d5b09a154a79cae36d8ac4321919ce62b4cbfb27f96828d89cfa3e566ed49d3bf28fc92f8a2fea26a113a50b82631a5935531c8135794dd076ee7599bd9505b348cac0d2241650c0f9179d67d4f258c81105bdd21846a9d3d9ca938ea3c27ce6950061560ddca2212dbe77d30caaf93a7488e712f61a3f117353a69747a3411c5820ac71b7ed777bb309310b0ddeffc57917b12e337985f7fed9d6e487b69f8a0d55eeaa61e08717fb44150a7d410e12c34d3a3c2022157763052c39b4599eebb55a9d6245f785a38a0e763615895054ab5e06c7e822fba50e1489623519c179908fd5f0ae941d7370f2810d5d2131b823142f3d9a1e505a044db17fe57bbf106a3cc0d2ed37b17a6142570d16ff85a8482601ba26759e87942f3dee5084f2e263519e41aaad8621e92994f5f6d4a5214bdf1d2b919475840c24c60b86ec74092506cacc3e490757afcb06090022c4d5d770116285e4da9bfd504fa9847c8d925883efc45a650f4c47becb090c7616a791254f14d2410d6afc80378921deb29f9681fcb4afd719e0b12caf52751ce878d72749c0acc602e49d0380f3c6726f5dcd62b2e9987e13a4a874abd12773e3be9ce79d23eba8ae8c141521f6ce7294d7f579abdcb382c9aa42150cf0daccac614372c3acefab4c247cea1d203f58f0c640ab0c8207ca8089e6a918ee9f676fe52f881cfce4957a7cf62ad9ba9a6628fd6302804e26db90eb9250b67a6e53a89f3d5773bc6c8150a0b6cefade9c545ed0c3cf1e05051e95cc8c5d009febfc480d68fc8b9d4e162b1ef1c51fd826148642d7b514f7392cb88f4849e2a0e23daf8ee32b4027568c75885afff1b8bc1d5fde2200c3c4f3cdf44cc6f5204cf16095ba801f9cc150389e5411638faa01f854b146a2b8771ddba708e35ed19862bfac058e6bc46071476cc82a312f2432e338f5ad30a5071e6c690fd52b7d606bf38adb91e49fc039c85a3834568f799801b1d377be2211419350a2e8735360f157f0efe17d045355fbff5d80eb78656fe83918eac06bcf01ec9a22d48972412180d7e4da8a663b4b153ed59046ff9cd821140770ff6b0cec10d3460df938ef67905397ee1101d4f757aed37f94e91899a4bd582e0a41b6d9ad6becb456234412459a636e5b784dfaa88e53dc1c30a7a13c4d69a426b014337e7375131430728f436cbf5cd1293ff3c9e2acb4a95916029d7548a479ca5ef025f2299e92eaaed12d9c3bf902c47c1942f02f6ec64260ea75aa55f23a6de25896683950951c17e01fcafe5b9aca79325c052f04eebd2ed72da3e094577134dbbeb6fe94cecdb1f0c2a17c1481dbfdfa86a4cdeeb10764f8800366765c399ff82a504872f5133e00c3b69df12864843d2c37a9e7586266f448b7da4eae2d5354cdac4ed79617de869583b470d6a789d9c81243e469321bb1d522545c31e8bf59f1c6bd71479874a0d01e38c6e2b2014d92b164213170b8c68c2e74a22c508a8e536ddab23c79343f22424ffd5f2ed0b7b4d7c86d1843b0514a29e5d9ab12dddfa3cbe4391999dd1a3f698bbf0b3042971bb247877baf65ed4da8140809e892c861b2cabb993aabfb5e4d4ac7bc38bcbec31823dfacd2ea4f2066b0a29dbc3324a536cf54645b03fefe751ae1f4a6a52d87966b460b16d0e30f4d56d067afad355c636751b70713c2c422b2dcbbfc12c571b059e8aba22467670c420610880f71efbd18c6b3ceddc5ab5499637afca603cd56fd48b6acfdea0dfa4acc30ae55f5ac5df364ac33b5922658446ddb6493a482be81597ad09ee19bb526168e43aa5a3372ed4de0233e7879e1aa135553974a0aa6018c384163c7c3a32a8051ba8ac1ddcc5544ed1a5d7059ec9f04ded0a532b76632a29f1100ba5a2bc6796f1b694521d4379001730ddd76735b876219e40e350a55e6e37701be91045f5d0fad5adf158f391e288d965a22c2686bbf7b1e19bcb68a02eb1d000f027ad89a3f61a640f9a9a29ec00c2edd5f1cb14e119aea845b0791d760bb52e4ec0bbf39b4d10130deee5b57c0cadf19b7b76bc964a7aea3f4747d89e1e27988352ecad13e3004af821084a8a6108cab2ead41892b3a8904f13169f074ed541021fddb20c49a28535f4703a29cf607fcf6b31b73d5729ad73231f55e5806dc1cbebcd1940f6d0dc0ce3f6ef9f80b1cad0b88e188e259b7723db024e820221aa3c7659820556ee517c54b8abd4b3be9da33b2113f29668c4fa85330a260f3581d8d17e94e451bc034b6cce62c07003b16ebe02b4d4c08c347458146ca0ca0b9a526c953d9596d9b1d0c43954ab187ad50135a8bc958287c85710362cdc8cf76716bedf6049548e7f0d5874b23cbcc71c2f03a93c747a25e2c227854451425392368d2b4daf4d955cfe0c53e626e6a18fc6e46f01bc8414e9030ecddf7de93f4c87dfa67384032013d027d3cecf2ccb8c7e46cafcee06d21ed06c04a8e179640863df08d16b731d21cac2667edce6efba5e0d9a1bc7860f841fef9071ba54e13fd9a6cb2a0efa476adbf304ef3cb3fcc5f9950d7e8eb834b7e80509951693f7c72358cfd4350471939f42e2ca3a455952755370393e4d3489ffb4a0c17b90bc434ae0593d27218b9b87529afb6fadd17a73a5f677bfcfad5f5ac2a0542f60b99aeedb7b4e5b39d7656e3ffd85e9673cc1d1a9f91b62c3f7677abd21c9d32c9a35894a91aaee43815f77edcde8cca375cecfb19f34be926b62a6421d213534030444265c18ba5421a910a6a50a06f88f9ee6c533a12f62901590a9725c2379394e9dbbc71f7792e79ef9f9013d1a5ff37deefc9d7353fecf0887474479f9338e5b07f3bc4d2ce3e3f12fe3a84c2fa4f0efdb6c2500b5bf0124c8267ae3607d68424710cf93ab861f530f417db7be1284a7d740ee7225550739c2d1ce62d7a3a7a30d623a75ee079b9d1fa39f5342ef9fbce33a150992360417352221509e1bb0c739f5be00a51a320dc81632b41295b3558a5045787815fbe6b5676b0953ce8dea3b17d3926764725e02ebae7e9ebc008d26bb5773e8af8f3acd900ac192596cef29dacd31b683d2ca1cda400596bfe9f6196bfb502784366c9944a187c2f928995108eae58f1a62b2a1ce2429242e9ac2620cd777f26f893aae3d359ac1d68bd7aaa58bf332842791b20d7383c2feefd761c809b23e69314523c09c54bb29b1b5ef0ecf85abe2f2d38a5eb09ce598f0f0e69e67f898e7b38d52d3ac7e99f63113af69e5c1db90cc026b20161a4be3e1f045e0c1b32ec86ef516c9845bb24bb0e6538d1dd4143c937977201a7a07ae43066acf7d1e18312911f4ee87c0702ab545d461b822cdf5cd5c835b4d44a0d5f0c50651983e6ffc88df056a03d3922aad996a417a2e54e435339e55531598bf71fa6754e0ce4dffd9f0e10d4319239802f55e5dc1e8fac57e12f6989f5b9899f68ba4351ef8f294f67f1cfe6ad7d4ce06ee47988ffb911acc015b20a2894064b7569bd47fab401fef525efe2e6d676105284517e45a99510b6574088516f9c287cac2382ad4d1c7ca1a5ccc2c7090d7d33f6424e3cba7254b8016b72e3132ab96fe0cd8c454c0e8a0616fd2e969324cd57f9f9f77bb15b01022171028ce8b9e42761888485e0713dc4ea5dd1661a9f71c3cf50467e7bcf8ab4831efd184c842fc924394e104570f369f063713d6260906328944310209ff22aed1d8a3cec0fc56405d4173801a8c110d94e7493afb3d2d5db644e312b92fafe36e0b2ab4ad73025280ea667818e3dc222849d729c165b0d056b96fd29131fcc8b4d2539466be0a20b5b4682fd9658d2f9df8a8cc73bda0ee4dbcbefad95cdee019926ef8cdb70f7f084ac224bd26ccc334c8e7b18a309b9e0bd0975ef134291664c656551bed4f62898a0a4341dcea3c54af28585c0a35f83b76f41fee5a5f158b49156a387be7163238307c9a360bc5c8f41b8e8c510e98e71c7c36d2cba730d8c3084d7c555e1824f8aab9b4f6f4a86c297fb41e96e6e8922af02a68457f8a527eb9ca7e58c6b179e431d771e28883033f3b1c1da36a0aed28233925bbb2089cda4756c359f4a1e762d3df505701b83e360e33cc8f909c325990ed23b6270038cd1b534c42b61b8c167d38b338aa7a1c840a5f525ab07cc22501caa0446c4598a22f9d974d110b60580ee6ed6a9407175f812866913a4c984c35fc14a6d2bd00113543ab387db02d83926220bab38a77937a9d4e54cd279d0f27fc0d7cfeae42dead3f86eb0d85dffa70750f2b9c4dad074996be7d8c5de80161637e55cf5ade5f802d257218d8b0217742461eb8bb8faa84304a110d20d26b42ae033a8fe8885f4b05348f0fe97c032698b3984bfaccdb7c55de3f4bd849fd691719d7b246bef189b893203117bb051262c898f66b943f9364ca8fe2923a566507adb51b2a127e7b06d6ae78a093239e65a918e7e09965222deb53f547410a9e97beec8ea8bd8ffadc86eef62407f972bc296ad66549ced9f54586dc51351b726a90f6dbbd261fe1fbc686a15af21694cb9c6ccf06addd4839d75919fe12809e3245e92ca60a9fd19c363895da02b5dcd8f839e6f271d003f55ad508727eb984fadcf983c592fad3b715de22172156472aab4dbdc25ee010acebe1e737a0d35ec92a9fbd57de46b340a48b42d6243d7f9819598bc4a217f31853337aca22ffa0778cfb78264ab0f4983eaa77a6ad92b7d2ee4894739d1d5eff2d905189d05307d9811e047e74ecc0b3ba1c9587b35bcb09e147f3cb2e99739bd07ba7d6f0fbfeedddac640c1cb39782236015f9ef6ea82dbd7317b73348b1f6d15089c34f6d387cd3f216d79867093b3cba121aebc830485b8677957703307d10f796832181b41a72dbb3830f86e1f8ffe25ed28a66c4ddc78d36073b0490f9ca5f47b3906308c5380d2ed9648a3cf5f28f0dd577af9257ae2e10c0a864f03f044e239f43f1e92d0fde67b3013a4a77d9bfd3183f61c3e67a15a7430024548fcf0d3813fc105fdb8ef69b9517f2d5ae4fa28d1a96ffe059ba91338c796db52df18fd16e760358d1ed38fad1156ba2155d9fa4253d82da7a50b5ecf3576ff0d61b8829d126795adf0654bf113eadae9a80ad9f554bc6bb573e2dab009687725a4b71ee495ee851292fc32e8011fce437b3f1bb0c4fede4eb2f80a4669f00753f7e80940c903d4c8b457e7c39fd674d679d5b27aa9718e782f8abdb5da6b557764875301528404726bffd297f86f6fcd26db745388af07071000c7d0eea79605ddedc93c5340be339a2442a182c4d644a2979a9849638d299a05db9ce620c5c686aa0c77a851a34ace61d3e4202b9de7a67fb944f2ca17ee452f0ba8e614d10b46c61b80f983cc96ad6682c8266599c4bcca287e556801c48a6ebb81f5f02823309a350e5c10dcc7ff5560cabb996f0013ba3749261cb21b68eda90bc8199753572c4e7e97fa5c0e6b9624c0c31f4a3e653e75390e43b8b858a9aa59fb593916eba503d60ad8285e200706959c97ef1a7bfb3999533b907793be95445985ba21aa89c72ca91dce59646e526ffbb8d8051d31702384b2bf356b1af04df333cb2eee513db56f2b92baf35f3bb428bdfa0c0caa16d06d49a896253734e23b657a0f07cbb8d253e352b16e54cab7d8c90cbfdf59142addbc2f4f935b0f3c5726809ad225cb6c988e4c83bccb3037df304d5cc0f1998963be253b70c8a04ba75c9ddf16c1a2ce707d0b1f4b8eb1d3ea9934e820a81b6c1bbbb78d79ca3cca6cf9754ffc208fa1bccd50bc7238b6c61f8ad2e4550ae42fcff2b89a784346ce1fc45421c02ad75f7d7b20a15d9cc6142d87aec136e7a1678903d09fc2ecc28a65a59f749d0990247d54273fc19236452d8581b14c10c61a84d451d48e09e547e312d78ac5dac1ba2146c10e0bef2110b0e649a487229ccd67bf2dc77e2ce3edb4d047fc9667751f40830a6e4dd5cedb5658ef6748118d1c2285f1c91929a06815c0ec5df91a6fb6a161f4ec27d5489a636347be58a1525d678a03c7846f1a8d426aab61fbee5460d43ff77b04a8926dcb0e0c6270f03a838179d19d192f5bc556f77670ae14c4af5278992e04d47c1ecd8b9236654f722f1d9bee8ce2d4f568789e70fb1e34bc2298f3c7066fd9cc591a8a43af3b3c05a03b83ab4e4f3c03d5dba420937fb8f751a1c7c51e6a78b8cc12e124fd6efb64a7f7d5f5d2a9f15c04d44235c787abb44c122a2aeb0fa204d3acdc22388222d234dda7897e9de024987e08e5afd5e17bc96556b3e6d835045084d1f13e2774dcb80b76a94461df393b7cee5e42167cef051128c6d9f69339fb99cb2d6690f4c338e33a7a117a674dc2d4b032bca49bde2ed4b8363f241af7a4a18f16bedd311bbcdfb74cfeb95503923090a4fb0370425ae52ad363877b1042d352109125bfccf616408240d1503f1c2573710beb7cadbb3f9703999e928326a44a1d2ffbbe5cacf2948555c51cf78268c2835ccb36bad7c0083da9dd88985ea0cbd17c9bf47ec0907828681f6df6f1725a7700edf22cd4280290bb5bd690e874ea4a1ecc8d04ccff4e38b250bc5cef0fa73b0374d42c0aa86f82694f64a51ce57d093020db58870ea114ea0721dabc47eb3813150030b979032f8646038445bd140d9462d6b70f906f2603c72d9ca0ca40667b4ec0b66e149ae8488a5b931831acb417c27faf4941eee39a0114b612545a9aa32ff1b00d0b07dfea637f88848a42a5c9c3838f237ba0dec3b958487d8819bee1933644f99398fe2467dab6af90d78199959cacf7acc2ad7df094727a9ea3712a21b96123fc68c9096c58f62e64a5704dc54149cb049fef7325105db3ad335152e9fc88c03d330d151aaa50a3abaa53fe7e329cea0856e27c857ca590e49afaaf3aabebfeafea94047baf08f55580fc10b778b5010d03e0f98e2d76770407dd0a1b91e168a0d5c060cd7dcbf47ab396f8a405681745b316138b4a6470413d9916580d271d40d778351e6808d928e541a2fd17df711f0edc8275204c5ba94844f52bba6223f251fc20ce2d5339252d22af6288f5f5e7bd456491dc3519839