struts2核心工作流程與原理doc-資料下載頁
2025-07-15 11:43本頁面
【正文】 name=scopeclass=/interceptorname=servletconfigclass=/interceptorname=sessionAutowiringclass=/interceptorname=timerclass=/interceptorname=tokenclass=/interceptorname=tokensessionclass=/interceptorname=validationclass=/interceptorname=workflowclass=/interceptorname=storeclass=/interceptorname=checkboxclass=/interceptorname=profilingclass=/7.一旦Action執(zhí)行完畢。如上文中將結(jié)構(gòu)返回“”，但大部分時(shí)候都是返回另外一個(gè)action，那么流程又得走一遍……… Struts2/XWork 遠(yuǎn)程命令執(zhí)行漏洞POC20101204struts2一種javaweb的MVC框架技術(shù)，和傳統(tǒng)的struts1有很大的改進(jìn)。struts2=struts +WebWork。WebWork是由OpenSymphony組織開發(fā)的，致力于組件化和代碼重用的拉出式MVC模式J2EE Web框架。， Oberg開發(fā)的WebWork，但現(xiàn)在WebWork已經(jīng)被拆分成了Xwork1和WebWork2兩個(gè)項(xiàng)目。XWork是一個(gè)標(biāo)準(zhǔn)的Command模 式實(shí)現(xiàn)，并且完全從 web層脫離出來。Xwork提供了很多核心功能：前端攔+截器（interceptor），運(yùn)行時(shí)表單屬性驗(yàn)證，類型轉(zhuǎn)換，強(qiáng)大的表達(dá)式語言（OGNL – the Object Graph Navigation Language），IoC（Inversion of Control倒置控制）容器等。其目的是：創(chuàng)建一個(gè)泛化的、可重用且可擴(kuò)展的命令模式框架，而不是一個(gè)特定在某個(gè)領(lǐng)域使用的框架。XWork存在遠(yuǎn)程命 令執(zhí)行漏洞。[+]info:~~~~~~~~~Friday, July 9, 2010CVE20101870:Struts2/XWorkremote mand execution[+]poc:~~~~~~~~~Actual proof of concept had to use OGNL’s expression evaluation when crafting HTTP request. PoC for this bug will be published on July 12 2010. To test whether your application is vulnerable you can use the following proof of concept, which will call ().exit(1):://mydomain/?(‘u0023_memberAccess[39。allowStaticMethodAccess39。]‘)(meh)=trueamp。(aaa)((‘u0023context[39。yMethodExecution39。]u003du0023foo’)(u0023foou003dnew%(“false”)))amp。(asdf)((‘(1)’)(u0023rtu003d@@getRuntime()))=1Fixing CVE20101870Struts2 users must upgrade to the , which whitelists a set of characters that excludes characters required to exploit this vulnerability.In cases where upgrade isn’t possible you can use ParameterInterceptor’s “excludeParams” parameter to whitelist the characters required for your application to operate correctly(usually Az09_.’”[]) alternatively you can blacklist ()@ which are the characters required to exploit this bug.[+]Reference:~~~~~~~~~~10 /
環(huán)評公示相關(guān)推薦
鄂ICP備17016276號-1