How to fix apache struts2 s2-045 vulnerable with f5 irule ?

Hi Robinchien,

you need to either create a whitelist containing your allowed

Content-Type

request-header values (most secure but sligthly difficult approach) or black-list certain characters (e.g.

@

,

.

,

,

,

,

(

or

)

) and attack-patterns (e.g.

ognl

,

memberaccess

,

getruntime

,

exec

), which will unlikely used by your application but required to pulloff the s2-045 remote execution (less secure but easy to implement).

Whitelist approach:

when HTTP_REQUEST {
    switch -exact -- [string tolower [HTTP::header value "Content-Type"]] {
        "" - 
        "multipart/form-data" -
        "text/xml; charset=utf-8" - 
        "application/x-www-form-urlencoded" {
             Allow request with empty or white listed "Content-Type" headers
        }
        default {
             Reject request with unknown "Content-Type" headers
            reject
        }
    }
}

Blacklist approach:

when HTTP_REQUEST {
    switch -glob -- [string tolower [HTTP::header value "Content-Type"]] {
        "*@*" - 
        "**" - 
        "*.*" - 
        "*,*" - 
        "*(*" - 
        "*)*" - 
        "*ognl*" - 
        "*memberaccess*" -
        "*getruntime*" - 
        "*exec*" {
             Reject requests with suspicious "Content-Type" headers
            reject
        }
        default {
             Allow request with unsuspicious "Content-Type" headers
        }  
    }
}

Cheers, Kai