Apache Struts < 2.2.0 Remote Command Execution

[Java-monitor RSS bot]

This Metasploit module exploits a remote command execution vulnerability in Apache Struts versions < 2.2.0. This issue is caused by a failure to properly handle unicode characters in OGNL extensive expressions passed to the web server. By sending a specially crafted request to the Struts application it is possible to bypass the "#" restriction on ParameterInterceptors by using OGNL context variables. Bypassing this restriction allows for the execution of arbitrary Java code.

More... (http://packetstormsecurity.org/files/view/104227/struts_code_exec.rb.txt)