CVE-2024-7314 PoC — AJ-Report 安全漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7314.yaml

Associated Vulnerability

Title:AJ-Report 安全漏洞 (CVE-2024-7314)
Description:AJ-Report是anji-plus开源的一个可视化设计工具。 AJ-Report 1.4.1之前版本存在安全漏洞，该漏洞源于远程未经身份验证的攻击者可以将swagger-ui附加到HTTP请求中以绕过身份验证并在受害服务器上执行任意Java。

Description

AJ-Report before version 1.4.1 is affected by an authentication bypass vulnerability. A remote and unauthenticated attacker can append ";swagger-ui" to HTTP requests to bypass authentication and execute arbitrary Java code on the victim server through script engine injection in the validation rules functionality.

File Snapshot


 id: CVE-2024-7314

info:
  name: AJ-Report < 1.4.1 - Remote Code Execution
  author: ritikchaddha
  

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!