Feature Request - Apache Struts RCE CVE-2018-11776

Hello,

I was wondering if you might consider implementing a check for CVE-2018-11776? I did read what you said in #8 about being a lightweight scanner addon, but I figure since CVE-2018-11776 is another OGNL related, simple payload it might not be that much work to implement?

An example exploit PoC can be found here. Or maybe an even better payload is just a simple addition injection one like in here ${(111+111)}, which gets executed and translated to 222. English translation.

Having this integrated into a Burp extension would be extremely valuable. The check for the older struts vuln (CVE-2017-5638) has certainly helped me out. The problem with vulnerability scanners is they don’t typically also crawl and if they do, it’s not deep. Where the check for CVE-2017-5638 has come in handy is for complex sites that have applications nested way past the web root /. Using Burp to crawl, then having that check performed six or seven /directories deep is just something a typical vulnerability scan will miss.

If this isn’t something you want to do, of course feel free to close this ticket as wontfix.

Cheers!

[xfox64x]

Just now seeing this. Sorry I couldn’t help more, and nice work figuring it out! I took a look at the commit, and it seems sufficient. Great work, and I look forward to using it.

[chriselgee]

Hey, thanks for the research! Works well on 2.3.32 - no hits on 5638.