Struts 2 development mode 漏洞

被这个漏洞害苦了,百度各种没找到答案 ，原来竟是自己粗心 ，升级struts时没有将web.xml里的这段代码删掉:

    struts2

    org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter

 

 

    struts2

    /*

 

在升级struts时 需要在web.xml里添加如下代码:

          < filter >

                 < filter-name >   StrutsPrepareFilter filter-name   >

                 < filter-class >   org.apache.struts2.dispatcher.ng.filter.StrutsPrepareFilter

                 filter-class >

          filter >

          < filter >

                 < filter-name >   StrutsExecuteFilter filter-name   >

                 < filter-class >   org.apache.struts2.dispatcher.ng.filter.StrutsExecuteFilter

                 filter-class >

          filter >

          < filter-mapping >

                 < filter-name >   StrutsPrepareFilter filter-name   >

                 < url-pattern >   /*   url-pattern >

          filter-mapping >

          < filter-mapping >

                 < filter-name >   StrutsExecuteFilter filter-name   >

                 < url-pattern >   /*   url-pattern >

          filter-mapping >

此段代码就是用来替换上面那段代码的,如果没删掉上面那段代码,在用AWVS 扫描的时候就会一直出现Struts 2 development mode 这个高危漏洞。原来是从struts2.1.3开始ActionContextCleanUp 和 FilterDispatcher 已经不建议使用了。 将使用StrutsPrepareFilter和StrutsExecuteFilter替代