## https://sploitus.com/exploit?id=DFBAF7FB-C163-5D2C-BF9E-3F46B82BF773
# Apache Ecosystem CVE Vulnerability Reproduction Testbed
> **Disclaimer**: This project is intended solely for security education and research purposes. All vulnerability reproduction environments are deployed using Docker containers. Do not use the exploitation methods in this project on unauthorized systems. Conducting penetration testing on others’ systems without authorization is illegal.
## Project Overview
This project collects **14** representative CVE vulnerabilities from the Apache ecosystem, covering core components such as Apache Struts2, Tomcat, Solr, HTTP Server, Log4j, and Commons Text. Each vulnerability is accompanied by a complete Docker reproduction environment, automated PoC scripts, and detailed analysis documentation in Chinese, making it ideal for security beginners to systematically learn about common vulnerability types.
## Vulnerability List
### Apache Struts2
| CVE ID | Vulnerability Name | CVSS | Vulnerability Type | Difficulty |
|----------|---------|------|-------- -|------|
| [CVE-2017-5638](./CVE-2017-5638/) | OGNL Expression Injection RCE (S2-045) | 10.0 | Remote Code Execution | ⭐ Recommended |
| [CVE-2017-9805](./CVE-2017-9805/) | REST Plugin XML Deserialization RCE (S2-052) | 8.1 | Deserialization RCE | Medium |
| [CVE-2018-11776](./CVE-2018-11776/) | Namespace OGNL Injection RCE (S2-057) | 8.1 | Remote Code Execution | Medium |
| [CVE-2020-17530](./CVE-2020-17530/) | Double OGNL Evaluation RCE (S2-061) | 9.8 | Remote Code Execution | Advanced |
### Apache Tomcat
| CVE Number | Vulnerability Name | CVSS | Vulnerability Type | Severity |
|----------|---------|------|-------- -|------|
| [CVE-2017-12615](./CVE-2017-12615/) | Arbitrary File Upload via PUT Method | 8.1 | Arbitrary File Upload | Beginner |
| [CVE-2019-0232](./CVE-2019-0232/) | CGI Servlet Command Injection | 8.1 | Command Injection | Analysis |
| [CVE-2020-1938](./CVE-2020-1938/) | Ghostcat AJP Protocol Vulnerability | 9.8 | File Reading/RCE | ⭐ Recommended |
### Apache Solr
| CVE ID | Vulnerability Name | CVSS | Vulnerability Type | Difficulty |
|--------- -|---------|------|---------|------|
| [CVE-2019-0193](./CVE-2019-0193/) | DataImportHandler RCE | 7.2 | Remote Code Execution | Medium |
| [CVE-2019-17558](./CVE-2019-17558/) | Velocity Template Injection RCE | 7.5 | Template Injection | Medium |
### Apache HTTP Server
| CVE Number | Vulnerability Name | CVSS | Vulnerability Type | Severity |
|----------|---------|----- -|---------|------|
| [CVE-2021-41773](./CVE-2021-41773/) | Path Traversal Vulnerability | 7.5 | Path Traversal | ⭐ Recommended |
| [CVE-2021-42013](./CVE-2021-42013/) | Path Traversal Bypass (Bypass of the fix for CVE-41773) | 9.8 | Path Traversal/RCE | ⭐ Recommended |
### Apache Log4j
| CVE Number | Vulnerability Name | CVSS | Vulnerability Type | Severity |
|----------|---------|------|---------|------|
| [CVE-2021-44228](./CVE-2021-44228/) | Log4Shell JNDI Injection RCE | 10.0 | Remote Code Execution | ⭐⭐⭐ Must-Learn |
| [CVE-2021-45046](./CVE-2021-45046/) | Log4Shell Patch Bypass | 9.0 | Remote Code Execution | Advanced |
### Apache Commons Text
| CVE Number | Vulnerability Name | CVSS | Vulnerability Type | Difficulty |
|----------|---------|------|-------- -|------|
| [CVE-2022-42889](./CVE-2022-42889/) | Text4Shell String Interpolation RCE | 9.8 | Remote Code Execution | Medium |
## Prerequisites
- **Docker**: 20.10 or later
- **Docker Compose**: v2.0 or later (it is recommended to use `docker compose` instead of `docker-compose`)
- **curl**: for sending HTTP requests
- **Python 3**: Required for some PoC scripts (e.g., Ghostcat)
- **Operating System**: Linux / macOS (Windows users are advised to use WSL2)
### Installation Verification
```bash
docker --version
docker-compose version
curl --version
python3 --version
```
## Project Structure
```
CVE-Apache-Ecosystem/
├── README.md # This file
├── .gitignore
├── CVE-2017-5638/ # Struts2 OGNL RCE
│ ├── README.md
│ ├── Dockerfile
│ ├── docker-compose.yml
│ └── poc.sh
├── CVE-2017-9805/ # Struts2 REST deserialization
│ ├── README.md
│ ├── Dockerfile
│ ├── docker-compose.yml
│ └── poc.sh
├ ── CVE-2018-11776/ # Struts2 Namespace Injection
│ ├── README.md
│ ├── Dockerfile
│ ├── docker-compose.yml
│ └── poc.sh
├── CVE-2020-17530/ # Struts2 Double OGNL Evaluation
│ ├── README.md
│ ├── Dockerfile
│ ├── docker-compose.yml
│ └── poc.sh
├── CVE-2017-12615/ # Tomcat PUT File Upload
│ ├── README.md
│ ├── Dockerfile
│ ├── docker-compose.yml
│ └── poc.sh
├── CVE-2019-0232/ # Tomcat CGI Command Injection
│ ├── README.md
│ ├── Dockerfile
│ ├── docker-compose.yml
│ └── poc.sh
├── CVE-2020-1938/ # Tomcat Ghostcat
│ ├── README.md
│ ├── Dockerfile
│ ├── docker-compose.yml
│ ├── poc.sh
│ └── ajp_exploit.py
├── CVE-2019-0193/ # Solr DIH RCE
│ ├── README.md
│ ├── docker-compose.yml
│ └── poc.sh
├── CVE-2019-17558/ # Solr Velocity RCE
│ ├── README.md
│ ├── docker-compose.yml
│ └── poc.sh
├── CVE-2021-41773/ # HTTPD Path Traversal
│ ├── README.md
│ ├── Dockerfile
│ ├── docker-compose.yml
│ └── poc.sh
├── CVE-2021-42013/ # HTTPD Path Traversal Bypass
│ ├── README.md
│ ├── Dockerfile
│ ├── docker-compose.yml
│ └── poc.sh
├── CVE-2021-44228/ # Log4Shell
│ ├── README.md
│ ├── Dockerfile
│ ├── docker-compose.yml
│ ├── poc.sh
│ └── app/
│ ├── VulnerableApp.java
│ └── log4j2.xml
├── CVE-2021-45046/ # Log4Shell bypass
│ ├── README.md
│ ├── Dockerfile
│ ├── docker-compose.yml
│ ├── poc.sh
│ └── app/
│ ├── VulnerableApp.java
│ └── log4j2.xml
└── CVE-2022-42889/ # Text4Shell
├── README.md
├── Dockerfile
├── docker-compose.yml
├── poc.sh
└── app/
└── VulnerableApp.java
```
## Recommended Learning Path
### Phase 1: Getting Started (Path Traversal + File Manipulation)
Understand the most fundamental Web security concepts:
1. **CVE-2021-41773** — Apache HTTPD path traversal (URL encoding bypass)
2. **CVE-2021-42013** — Bypassing the patch (double URL encoding; understanding the risks of incomplete patches)
3. **CVE-2017-12615** — Tomcat PUT file upload (Understanding HTTP Methods and File Upload Vulnerabilities)
### Phase 2: Core (Expression Injection + RCE)
Master expression injection and remote code execution:
4. **CVE-2017-5638** — Struts2 OGNL Injection (A Classic Among Classics)
5. **CVE-2021-44228** — Log4Shell (The most impactful vulnerability in recent years; a must-learn)
6. **CVE-2022-42889** — Text4Shell (Study in comparison with Log4Shell)
## # Phase 3: Advanced (Deserialization + Protocol-Level Vulnerabilities)
In-depth understanding of Java security and protocol-level attacks:
7. **CVE-2017-9805** — Struts2 XStream Deserialization
8. **CVE-2020-1938** — Ghostcat AJP Protocol Vulnerability
9. **CVE-2019-17558** — Solr Velocity Template Injection
### Phase 4: Advanced (Bypass + Vulnerability Variants)
Understanding the Limitations of Security Patches and Vulnerability Variants:
10. **CVE-2018-11776** — Struts2 Namespace Injection
11. **CVE-2020-17530** — Struts2 Double OGNL Evaluation (Sandbox Escape)
12. **CVE-2021-45046** — Log4Shell Patch Bypass
13. **CVE-2019-0193** — Solr DIH RCE
14. **CVE-2019-0232** — Tomcat CGI Command Injection (Proof of Concept)
## Quick Start
```bash
# 1. Select a CVE directory
cd CVE-2021-44228
# 2. Start the vulnerability environment
docker compose up -d
# 3. Run the PoC script
./poc.sh
# 4. Read the README to understand the mechanism
cat README.md
# 5. Clean up the environment
docker compose down
```
## Vulnerability Type Knowledge Graph
```
Apache Ecosystem Vulnerabilities
├── Expression Injection
│ ├── OGNL Injection (Struts2: S2-045, S2-057, S2-061)
│ ├── JNDI Injection (Log4j: Log4Shell)
│ ├── Template Injection (Solr: Velocity Template)
│ └── String Interpolation (Commons Text: Text4Shell)
├── Path Traversal
│ ├── URL Encoding Bypass (HTTPD: CVE-2021-41773)
│ └── Double Encoding Bypass (HTTPD: CVE-2021-42013)
├── Deserialization
│ └── XStream Deserialization (Struts2: S2-052)
├── Protocol-Level Vulnerabilities
│ └── AJP Protocol Abuse (Tomcat: Ghostcat)
├── File Manipulation
│ └── Arbitrary File Upload (Tomcat: CVE-2017-12615)
└── Command Injection
└── CGI Parameter Injection (Tomcat: CVE-2019-0232)
```
## Port Assignment
To avoid port conflicts, each test environment uses a different port:
| CVE | Component | Port | Protocol |
|-----|------|------|------|
| CVE-2017-5638 | Struts2 | 8080 | HTTP |
| CVE-2017-9805 | Struts2 | 8080 | HTTP |
| CVE-2018-11776 | Struts2 | 8080 | HTTP |
| CVE-2020-17530 | Struts2 | 8080 | HTTP |
| CVE-2017-12615 | Tomcat | 8080 | HTTP |
| CVE-2019-0232 | Tomcat | 8080 | HTTP |
| CVE-2020-1938 | Tomcat | 8080 / 8009 | HTTP / AJP |
| CVE-2019-0193 | Solr | 8983 | HTTP |
| CVE-2019 -17558 | Solr | 8983 | HTTP |
| CVE-2021-41773 | HTTPD | 8080 | HTTP |
| CVE-2021-42013 | HTTPD | 8081 | HTTP |
| CVE-2021-44228 | Log4j | 8082 | HTTP |
| CVE-2021-45046 | Log4j | 8083 | HTTP |
| CVE-2022-42889 | Commons Text | 8084 | HTTP |
> **Note**: Do not run multiple test environments using the same port simultaneously; if necessary, modify the port mappings in `docker-compose.yml`.
## Security Tips
1. **Use only in an isolated environment**: It is recommended to run this on a virtual machine or a dedicated test machine.
2. **Do not expose to the public internet**: Ensure that Docker containers listen only on `localhost`.
3. **Clean up promptly**: After reproducing the vulnerability, use `docker compose down` to shut down the environment.
4. **For Educational Purposes Only**: Understanding vulnerability mechanisms is intended to improve defense, not to facilitate attacks
## Reference Resources
- [NVD - National Vulnerability Database](https://nvd.nist.gov/)
- [Apache Security](https://www.apache.org/security/)
- [OWASP Top 10](https://owasp.org/www-project-top-ten/)
- [CVE Details](https://www.cvedetails.com/)