Juggle ships the H2 database web console enabled and reachable from
non-localhost by default. No application-level authentication covers
the /h2-console path, and the shipped default datasource credentials
(sa/juggle) are known. An unauthenticated remote attacker can reach the
console and, using the default credentials, achieve OS command
execution on the host via the H2 CREATE ALIAS Runtime.exec() technique.
登录后查看神龙缓存的 POC 文件快照
登录查看