Return-Path: X-Original-To: archive-asf-public-internal@cust-asf2.ponee.io Delivered-To: archive-asf-public-internal@cust-asf2.ponee.io Received: from cust-asf.ponee.io (cust-asf.ponee.io [163.172.22.183]) by cust-asf2.ponee.io (Postfix) with ESMTP id 677CF200C31 for ; Thu, 9 Mar 2017 00:02:43 +0100 (CET) Received: by cust-asf.ponee.io (Postfix) id 65721160B88; Wed, 8 Mar 2017 23:02:43 +0000 (UTC) Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by cust-asf.ponee.io (Postfix) with SMTP id B1E7E160B83 for ; Thu, 9 Mar 2017 00:02:42 +0100 (CET) Received: (qmail 88978 invoked by uid 500); 8 Mar 2017 23:02:41 -0000 Mailing-List: contact user-help@struts.apache.org; run by ezmlm Precedence: bulk List-Unsubscribe: List-Help: List-Post: List-Id: "Struts Users Mailing List" Reply-To: "Struts Users Mailing List" Delivered-To: mailing list user@struts.apache.org Received: (qmail 4772 invoked by uid 99); 8 Mar 2017 22:32:59 -0000 X-Virus-Scanned: Debian amavisd-new at spamd4-us-west.apache.org X-Spam-Flag: NO X-Spam-Score: -0.071 X-Spam-Level: X-Spam-Status: No, score=-0.071 tagged_above=-999 required=6.31 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=disabled Authentication-Results: spamd4-us-west.apache.org (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=URcja9Mr8Ukwu7u0xOaJta0ussCa0qa7CEEq0PxzpSw=; b=X86LJRE8VP0R8gtS+aFxHo8tCD7JKpzXDZpxqIF/WHi1FSK7gDJCT+M+RHDOXJgNMh TSLuYwHog2Jd+xDVCHo5CKS6oCadHoMtnVyh9Cp7wlbL79mkwqo2rhmICXYQWs9azbxN PbD6GAV9Y+B+yzKJCCkNy19hjmtT7CKD5gFcUElFAdHiSOvF27xFXt6w1RKD2c/Lw9kX KCrED7nvXamux/EENU1bzv3bU2xox/cPylIauULHQH3qkX1y5zPD6sHnNbbhD0zyNScr JcBmjEbjuGJCXKkGQqXSaHpu/4gEfvHMMnthLJfQu7TZhKnoQ8vsJROH2Usdj/7TMmtA wo4Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=URcja9Mr8Ukwu7u0xOaJta0ussCa0qa7CEEq0PxzpSw=; b=nmyjRHdm8Map547GIMSxNLN0Mq0fC/iA12XOUm3n6yANs9HgBsgkw2rLEZ1Sb5orOn XtLhTA3iJD+txUmduolvvaiobvkyxcVT9+TW9BZiJK4KPdfMNMt+QtFiwQK0uA9f+Rjt C+qkL+gZFUogqYZEPpp1lip+h4tEFTioH7QJ5IZ5NEFasRFamUoF9KPKcIZuf0nYYOC2 pSrRoI/OilBg+gC1b+AxAw1I51kk1BDRATm4cqq7bLAKmIEdtFqnzY2t32liPnNM/jid udN9yEAEhT1wO1+co0NNEC/1Otj4arRtIJhTe1wI/SSg6XAtRY/ZqvD2zgonp0NzpnLh x3eg== X-Gm-Message-State: AMke39lkKMH/HauQoIHZ3pYBh96qxFwvgE0RCi3XxVDotHnRt+k7yr5z8jX5PlGyZDb0AwbwqvNZQ8/JR3EQbg== X-Received: by 10.13.215.199 with SMTP id z190mr2316240ywd.325.1489010697103; Wed, 08 Mar 2017 14:04:57 -0800 (PST) MIME-Version: 1.0 From: Jim Spellman Date: Wed, 8 Mar 2017 17:04:56 -0500 Message-ID: Subject: ognl exploit To: user@struts.apache.org Content-Type: text/plain; charset=UTF-8 archived-at: Wed, 08 Mar 2017 23:02:43 -0000 Is there a way to turn off ognl, so to prevent this exploit? https://github.com/rapid7/metasploit-framework/issues/8064 I found someone trying to break into my server and was able to issue system level commands by injecting this ognl language into the content header of a multipart form. I'm currently using: struts2-core-2.5.2.jar ognl-3.1.10.jar Any help would be appreciated. Thanks... Jim --------------------------------------------------------------------- To unsubscribe, e-mail: user-unsubscribe@struts.apache.org For additional commands, e-mail: user-help@struts.apache.org