Mitigate Apache strut2 vulnerability, cve-2017-5638

The RCA is the function 'findText' will execute the injection code. That means, before execute the injection code, attacker need to trigger an exception.

Thus, the necessary and sufficient conditions are as below:

• The Request contains 'Content-Type'
• The Content-Type contains 'multipart/form-data'
• The Content-Type should be illegal to trigger Error Key 'struts.messages.error.content.type.not.allowed'

(refer to: https://cwiki.apache.org/confluence/display/WW/File+UploadFileUpload-AlternateLibraries)

This maybe explained why the FW vendor's sig is using starts_with like below (currently, most PoC codes are added additional characters in the beginning of Content-Type):

if {($ctheader contains "multipart/form-data") and not($ctheader starts_with "multipart/form-data")}{

I suspect that if modify the PoC string like 'haha%{}multipart/form-data' or 'multipart/form-datahaha%{}' may have same result. That means 'starts_with' may not be exact enough for block the injection. Therefore, I would prefer to choose Linjing's irule. It would be better.