漏洞描述
The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
cwiki.apache.orghttps://cwiki.apache.org/confluence/display/WW/S2-008 https://blog.csdn.net/weixin_43416469/article/details/113850545↗lists.immunityinc.comhttps://lists.immunityinc.com/pipermail/dailydave/2012-January/000011.html↗web.archive.orghttp://web.archive.org/web/20150110183326/http://secunia.com:80/advisories/47393↗struts.apache.orghttp://struts.apache.org/2.x/docs/s2-008.html↗