CVE-2016-3081

EPSS 93.7%

Vexday Risk Score

60Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 93.7%KEV nãoPoC públicaNuclei simMetasploit simPatch —

Lifecycle

26 Apr 2016Published on NVD

27 Apr 2016Metasploit module available

02 May 2016Public PoC

Weaponization speed

5 daysto first PoC

same dayto Metasploit module

Weaponized quickly — attackers prioritized this vulnerability. Patch urgently.

Recommendation: Plan a near-term fix — a public PoC already exists.

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

Affected products

n/a · n/a

public PoCs found — 3

cve_referencepacketstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.htmlunverified cve_referencewww.exploit-db.com/exploits/39756/unverified exploitdbwww.exploit-db.com/exploits/39756unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html https://struts.apache.org/docs/s2-032.html https://www.exploit-db.com/exploits/39756/http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec http://www.securityfocus.com/bid/87327 http://www.securityfocus.com/bid/91787 http://www.securitytracker.com/id/1035665