fix: rename struct2 -> struts2

vul/vul-struts2/build.gradle.kts

@@ -0,0 +1,26 @@
+plugins {
+    id("war")
+}
+
+java {
+    toolchain {
+        languageVersion = JavaLanguageVersion.of(8)
+    }
+    sourceCompatibility = JavaVersion.VERSION_1_6
+    targetCompatibility = JavaVersion.VERSION_1_6
+}
+
+
+dependencies {
+    implementation("org.apache.struts:struts2-core:2.5.30")
+    implementation("commons-fileupload:commons-fileupload:1.3.3")
+    implementation("commons-fileupload:commons-fileupload:1.3.3")
+    implementation("commons-beanutils:commons-beanutils:1.9.2")
+    providedCompile("javax.servlet:servlet-api:2.5")
+}
+
+
+
+tasks.test {
+    useJUnitPlatform()
+}

vul/vul-struts2/src/main/java/Base64ClassLoaderAction.java

@@ -0,0 +1,52 @@
+import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.ServletActionContext;
+
+import java.lang.reflect.Method;
+import java.net.URL;
+import java.net.URLClassLoader;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/24
+ */
+public class Base64ClassLoaderAction extends ActionSupport {
+
+    private String data;
+
+    static byte[] decodeBase64(String base64Str) throws Exception {
+        try {
+            Class<?> decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        } catch (Exception var4) {
+            Class<?> decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke((Object) null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        }
+    }
+
+    public Class<?> reflectionDefineClass(byte[] classBytes) throws Exception {
+        URLClassLoader urlClassLoader = new URLClassLoader(new URL[0], Thread.currentThread().getContextClassLoader());
+        Method defMethod = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, Integer.TYPE, Integer.TYPE);
+        defMethod.setAccessible(true);
+        return (Class<?>) defMethod.invoke(urlClassLoader, classBytes, 0, classBytes.length);
+    }
+
+    public String execute() throws Exception {
+        try {
+            byte[] bytes = decodeBase64(data);
+            Object obj = reflectionDefineClass(bytes).newInstance();
+            ServletActionContext.getResponse().getWriter().print(obj);
+            return null;
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    public String getData() {
+        return data;
+    }
+
+    public void setData(String data) {
+        this.data = data;
+    }
+}

vul/vul-struts2/src/main/java/BigIntegerClassLoaderAction.java

@@ -0,0 +1,37 @@
+import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.ServletActionContext;
+
+import javax.servlet.http.HttpServletRequest;
+import java.lang.reflect.Method;
+import java.net.URL;
+import java.net.URLClassLoader;
+
+/**
+ * @author Wans
+ * @since 2025/08/25
+ */
+public class BigIntegerClassLoaderAction extends ActionSupport {
+    static byte[] decodeBigInteger(String bigIntegerStr) throws Exception {
+        Class<?> decoderClass = Class.forName("java.math.BigInteger");
+        return (byte[]) decoderClass.getMethod("toByteArray").invoke(decoderClass.getConstructor(String.class, int.class).newInstance(bigIntegerStr, Character.MAX_RADIX));
+    }
+
+    public String execute() throws Exception {
+        try {
+            HttpServletRequest request = ServletActionContext.getRequest();
+            String data = request.getParameter("data");
+            byte[] bytes = decodeBigInteger(data);
+            reflectionDefineClass(bytes).newInstance();
+            return ActionSupport.SUCCESS;
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    public Class<?> reflectionDefineClass(byte[] classBytes) throws Exception {
+        URLClassLoader urlClassLoader = new URLClassLoader(new URL[0], Thread.currentThread().getContextClassLoader());
+        Method defMethod = ClassLoader.class.getDeclaredMethod("defineClass", byte[].class, Integer.TYPE, Integer.TYPE);
+        defMethod.setAccessible(true);
+        return (Class<?>) defMethod.invoke(urlClassLoader, classBytes, 0, classBytes.length);
+    }
+}

vul/vul-struts2/src/main/java/JavaReadObjAction.java

@@ -0,0 +1,46 @@
+import com.opensymphony.xwork2.ActionSupport;
+
+import java.io.ByteArrayInputStream;
+import java.io.ObjectInputStream;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/10
+ */
+public class JavaReadObjAction extends ActionSupport {
+
+    private String data;
+
+    byte[] decodeBase64(String base64Str) throws Exception {
+        Class<?> decoderClass;
+        try {
+            decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        } catch (Exception ignored) {
+            decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke(null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        }
+    }
+
+    @Override
+    public String execute() throws Exception {
+        try {
+            ByteArrayInputStream inputStream = new ByteArrayInputStream(decodeBase64(data));
+            ObjectInputStream bis = new ObjectInputStream(inputStream);
+            bis.readObject();
+            bis.close();
+        } catch (Exception ignored) {
+
+        }
+        return SUCCESS;
+    }
+
+    public String getData() {
+        return data;
+    }
+
+    public void setData(String data) {
+        this.data = data;
+    }
+}

vul/vul-struts2/src/main/java/ScriptEngineAction.java

@@ -0,0 +1,32 @@
+import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.ServletActionContext;
+
+import javax.script.ScriptEngineManager;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/3
+ */
+public class ScriptEngineAction extends ActionSupport {
+
+    private String data;
+
+    @Override
+    public String execute() throws Exception {
+        try {
+            Object eval = new ScriptEngineManager().getEngineByName("js").eval(data);
+            ServletActionContext.getResponse().getWriter().println(eval.toString());
+            return SUCCESS;
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    public String getData() {
+        return data;
+    }
+
+    public void setData(String data) {
+        this.data = data;
+    }
+}

vul/vul-struts2/src/main/java/TestAction.java

@@ -0,0 +1,13 @@
+import com.opensymphony.xwork2.ActionSupport;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/7
+ */
+public class TestAction extends ActionSupport {
+
+    @Override
+    public String execute() throws Exception {
+        return SUCCESS;
+    }
+}

vul/vul-struts2/src/main/java/UploadAction.java

@@ -0,0 +1,62 @@
+import com.opensymphony.xwork2.ActionSupport;
+import org.apache.commons.io.FileUtils;
+import org.apache.struts2.ServletActionContext;
+
+import java.io.File;
+
+/**
+ * @author ReaJason
+ * @since 2024/11/26
+ */
+public class UploadAction extends ActionSupport {
+
+    private File upload;
+    private String uploadFileName;
+    private String uploadContentType;
+
+    private static final String UPLOAD_DIRECTORY = "/";
+
+    @Override
+    public String execute() throws Exception {
+        try {
+            if (upload != null) {
+                String uploadFolder = ServletActionContext.getServletContext().getRealPath(UPLOAD_DIRECTORY);
+                if (!uploadFolder.endsWith(File.separator)) {
+                    uploadFolder += File.separator;
+                }
+                String uploadPath = uploadFolder + uploadFileName;
+                File destFile = new File(uploadPath);
+                FileUtils.copyFile(upload, destFile);
+                ServletActionContext.getResponse().getWriter().println("file upload success: " + uploadPath);
+            }
+            return SUCCESS;
+        } catch (Exception e) {
+            ServletActionContext.getResponse().getWriter().println("file upload failed: " + e.getMessage());
+            return ERROR;
+        }
+    }
+
+    public File getUpload() {
+        return upload;
+    }
+
+    public void setUpload(File upload) {
+        this.upload = upload;
+    }
+
+    public String getUploadFileName() {
+        return uploadFileName;
+    }
+
+    public void setUploadFileName(String uploadFileName) {
+        this.uploadFileName = uploadFileName;
+    }
+
+    public String getUploadContentType() {
+        return uploadContentType;
+    }
+
+    public void setUploadContentType(String uploadContentType) {
+        this.uploadContentType = uploadContentType;
+    }
+}

vul/vul-struts2/src/main/resources/struts.xml

@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE struts PUBLIC
+        "-//Apache Software Foundation//DTD Struts Configuration 2.5//EN"
+        "http://struts.apache.org/dtds/struts-2.5.dtd">
+
+<struts>
+    <constant name="struts.devMode" value="true"/>
+    <constant name="struts.multipart.maxSize" value="52428800"/>
+
+    <package name="default" extends="struts-default">
+        <action name="test" class="TestAction">
+            <result name="success">/index.html</result>
+        </action>
+        <action name="upload" class="UploadAction">
+            <interceptor-ref name="fileUpload">
+                <param name="maximumSize">10485760</param>
+            </interceptor-ref>
+            <interceptor-ref name="defaultStack"/>
+            <result name="success">/index.html</result>
+            <result name="error">/index.html</result>
+        </action>
+        <action name="js" class="ScriptEngineAction">
+            <result name="success">/index.html</result>
+        </action>
+        <action name="java_deserialize" class="JavaReadObjAction">
+            <result name="success">/index.html</result>
+        </action>
+        <action name="b64" class="Base64ClassLoaderAction">
+            <result name="success">/index.html</result>
+        </action>
+        <action name="biginteger" class="BigIntegerClassLoaderAction">
+            <result name="success">/index.html</result>
+        </action>
+    </package>
+</struts>

vul/vul-struts2/src/main/webapp/WEB-INF/web.xml

@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xmlns="http://java.sun.com/xml/ns/javaee"
+         xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
+         id="WebApp_ID" version="2.5">
+
+    <welcome-file-list>
+        <welcome-file>index.html</welcome-file>
+    </welcome-file-list>
+
+    <filter>
+        <filter-name>struts2</filter-name>
+        <filter-class>org.apache.struts2.dispatcher.filter.StrutsPrepareAndExecuteFilter</filter-class>
+    </filter>
+
+    <filter-mapping>
+        <filter-name>struts2</filter-name>
+        <url-pattern>/*</url-pattern>
+    </filter-mapping>
+
+</web-app>

vul/vul-struts2/src/main/webapp/index.html

@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Struts2 Test</title>
+</head>
+<body>
+<h1>Welcome to Struts2 Test Application</h1>
+</body>
+</html>