ID:10999 - Exploit for Path traversal in Apache Struts - CVE-2024-53677

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in filenames during file upload within Action File Upload Interceptor. A remote attacker can upload a specially crafted file to the server into an arbitrary directory.

Successful exploitation may allow an attacker to upload an arbitrary file and execute it on the server, leading to a full system compromise.

Remediation