Atlassian FishEye Struts 2 ParametersInterceptor Remote Code Execution Exploit

This module exploits a remote code execution vulnerability in the XWork component of Atlassian FishEye, by sending specially crafted HTTP requests to the port 8060/TCP. The ParametersInterceptor class of the XWork framework, part of the Struts 2 web framework, as shipped with Atlassian FishEye, does not properly restrict access to server-side objects. This can be exploited by remote unauthenticated attackers to modify server-side objects and finally execute arbitrary commands via specially crafted OGNL (Object-Graph Navigation Language) expressions.