VMware vCenter Server CVE-2021-21972远程代码执行漏洞

@RequestMapping(      value = {"/uploadova"},      method = {RequestMethod.POST}   )   public void uploadOvaFile(@RequestParam(value = "uploadFile",required = true) CommonsMultipartFile uploadFile, HttpServletResponse response) throws Exception {      logger.info("Entering uploadOvaFile api");      int code = uploadFile.isEmpty() ? 400 : 200;      PrintWriter wr = null;      try {         if (code != 200) {            response.sendError(code, "Arguments Missing");            return;         }         wr = response.getWriter();      } catch (IOException var14) {         var14.printStackTrace();         logger.info("upload Ova Controller Ended With Error");      }      response.setStatus(code);      String returnStatus = "SUCCESS";      if (!uploadFile.isEmpty()) {         try {            logger.info("Downloading OVA file has been started");            logger.info("Size of the file received  : " + uploadFile.getSize());            InputStream inputStream = uploadFile.getInputStream();            File dir = new File("/tmp/unicorn_ova_dir");            if (!dir.exists()) {               dir.mkdirs();            } else {               String[] entries = dir.list();               String[] var9 = entries;               int var10 = entries.length;               for(int var11 = 0; var11 < var10; ++var11) {                  String entry = var9[var11];                  File currentFile = new File(dir.getPath(), entry);                  currentFile.delete();               }               logger.info("Successfully cleaned : /tmp/unicorn_ova_dir");            }            TarArchiveInputStream in = new TarArchiveInputStream(inputStream);            TarArchiveEntry entry = in.getNextTarEntry();            ArrayList result = new ArrayList();            while(entry != null) {               if (entry.isDirectory()) {                  entry = in.getNextTarEntry();               } else {                  File curfile = new File("/tmp/unicorn_ova_dir", entry.getName());                  File parent = curfile.getParentFile();                  if (!parent.exists()) {                     parent.mkdirs();                  }                  OutputStream out = new FileOutputStream(curfile);                  IOUtils.copy(in, out);                  out.close();                  result.add(entry.getName());                  entry = in.getNextTarEntry();               }            }            in.close();            logger.info("Successfully deployed File at Location :/tmp/unicorn_ova_dir");         } catch (Exception var15) {            logger.error("Unable to upload OVA file :" + var15);            returnStatus = "FAILED";         }      }      wr.write(returnStatus);      wr.flush();      wr.close();   }