rapid7/metasploit-framework — pull request #1624 by Console (2013-03-21 14:13:24+00:00)
Title: Struts <= 2.3.1.1 Parameter Interceptor Remote Code Execution

OGNL provides, among other features, extensive expression evaluation capabilities.

This exploit bypasses all the protections (regex pattern, deny method invocation) built into the ParametersInterceptor, thus being able to inject a malicious expression in any exposed string variable for further evaluation.

Exploit has been tested against the following:
- Struts 2.3.1.1 (in all cases)
- Windows 2k3, Tomcat 7, JRE 1.7.0_17
- CentOS 6.4, Tomcat 6, OpenJDK-1.7.0_09-icedtea