From fbb770a53994a49d7c43c1b24c48703c4dd2e69a Mon Sep 17 00:00:00 2001
From: Sanjay Mahajan <mahajansanjay@google.com>
Date: Tue, 21 Jul 2026 09:20:24 +0000
Subject: [PATCH] added testbeds for CVE-2013-2251

---
 apache/struts/CVE-2013-2251/README.md         | 19 +++++++++++++
 .../struts/CVE-2013-2251/docker-compose.yml   | 27 +++++++++++++++++++
 2 files changed, 46 insertions(+)
 create mode 100644 apache/struts/CVE-2013-2251/README.md
 create mode 100644 apache/struts/CVE-2013-2251/docker-compose.yml

diff --git a/apache/struts/CVE-2013-2251/README.md b/apache/struts/CVE-2013-2251/README.md
new file mode 100644
index 00000000..4b6bc9d2
--- /dev/null
+++ b/apache/struts/CVE-2013-2251/README.md
@@ -0,0 +1,19 @@
+# Apache Struts2 S2-016 DefaultActionMapper OGNL Injection (CVE-2013-2251)
+
+The redirect and redirectAction prefixes allow unauthenticated remote attackers to execute arbitrary OGNL expressions via manipulated URL parameters, leading to system command execution.
+
+## Vulnerable Version
+### Setup
+Start an Apache Struts2 version 2.3.15:
+
+```bash
+docker compose up -d struts2-vuln
+```
+
+## Safe Version 
+### Setup
+Start an Apache Struts2 version 2.3.15.1:
+
+```bash
+docker compose up -d struts2-safe
+```
\ No newline at end of file
diff --git a/apache/struts/CVE-2013-2251/docker-compose.yml b/apache/struts/CVE-2013-2251/docker-compose.yml
new file mode 100644
index 00000000..e8879c33
--- /dev/null
+++ b/apache/struts/CVE-2013-2251/docker-compose.yml
@@ -0,0 +1,27 @@
+services:
+  # ---------------------------------------------------------
+  # VULNERABLE INSTANCE (Port 8080)
+  # Uses the VulApps image vulnerable to CVE-2013-2251
+  # ---------------------------------------------------------
+  struts2-vuln:
+    image: docker.io/medicean/vulapps:s_struts2_s2-016
+    container_name: struts2-vuln
+    ports:
+      - "8080:8080"
+    restart: always
+
+  # ---------------------------------------------------------
+  # PATCHED INSTANCE (Port 8081)
+  # Downloads the official Struts 2.3.15.1 patch release on boot
+  # ---------------------------------------------------------
+  struts2-safe:
+    image: tomcat:8.5-jre8
+    container_name: struts2-safe
+    ports:
+      - "8081:8080"
+    command: >
+      bash -c "
+      curl -fsSL https://repo1.maven.org/maven2/org/apache/struts/struts2-showcase/2.3.15.1/struts2-showcase-2.3.15.1.war -o /usr/local/tomcat/webapps/ROOT.war &&
+      catalina.sh run
+      "
+    restart: always