1

String sql="select * from user where id="+id

1
2

session.createQuery("from Book where title like '%" + userInput + "%' and published = true")

1
2
3

Select * from news where title like ‘%${title}%’
Select * from news where id in (${id})，
Select * from news where title =‘java’ order by ${time} asc

1
2
3
4

stmt=conncetion.prepareStatement(sqlString);
				stmt.setString(1,userName);
				stmt.setString(2,itemName);
				rs=stmt.executeQuery();

1
2
3
4
5
6
7

......
String sqlString = "select * from db_user where username=? and password=?";
        PreparedStatement stmt = connection.prepareStatement(sqlString);
        stmt.setString(1, username);
        stmt.setString(2, pwd);
        ResultSet rs = stmt.executeQuery();
......

1
2
3
4
5
6
7
8

@RequestMapping("/xss")
public ModelAndView xss(HttpServletRequest request,HttpServletResponse
response) throws ServletException,IOException{
 String name = request.getParameter("name");
 ModelAndView mav = new ModelAndView("mmc");
 mav.getModel().put("uname", name);
 return mav;
}

1
2
3
4
5
6
7
8
9

<%  ...
    Statement stmt = conn.createStatement();
    ResultSet rs = stmt.executeQuery("select * from users where id =" + id);
    String address = null;
    if (rs != null) {
        rs.next();
        address = rs.getString("address");
    }
%>

1
2
3
4
5
6
7
8

<filter>  
        <filter-name>XssSafe</filter-name>  
        <filter-class>XssFilter</filter-class>  
    </filter>  
    <filter-mapping>  
        <filter-name>XssSafe</filter-name>  
        <url-pattern>/*</url-pattern>  
    </filter-mapping>

1
2
3
4
5
6
7
8
9
10
11
12
13

javax.xml.parsers.DocumentBuilder
javax.xml.stream.XMLStreamReader
org.jdom.input.SAXBuilder
org.jdom2.input.SAXBuilder
javax.xml.parsers.SAXParser
org.dom4j.io.SAXReader 
org.xml.sax.XMLReader
javax.xml.transform.sax.SAXSource 
javax.xml.transform.TransformerFactory 
javax.xml.transform.sax.SAXTransformerFactory 
javax.xml.validation.SchemaFactory
javax.xml.bind.Unmarshaller
javax.xml.xpath.XPathEx

1
2

if (!Pattern.matches("[_a-bA-B0-9]+", user.getUserId()))
if (!Pattern.matches("[_a-bA-B0-9]+", user.getDescription()))

1

file ftp mailto http https jar netdoc

1
2
3
4
5
6
7
8
9
10
11
12
13

String url = request.getParameter("url");
         String htmlContent;
         try {
             URL u = new URL(url);
             //URL对象用openconnection()获得openConnection类对象。
             URLConnection urlConnection = u.openConnection();
             HttpURLConnection httpUrl = (HttpURLConnection) urlConnection;
             BufferedReader base = new BufferedReader(new InputStreamReader(httpUrl.getInputStream(), "UTF-8"));
             //用inputStream获取字节流然后使用InputStreamReader转化为字符流。
             StringBuffer html = new StringBuffer();
             while ((htmlContent = base.readLine()) != null) {
                 html.append(htmlContent);
             }

1

Request.Get(url).execute()

1
2
3
4
5

URL u;
int length;
byte[] bytes = new byte[1024];
u = new URL(url);
inputStream = u.openStream();

1
2
3
4
5
6
7

String url = "http://127.0.0.1";
CloseableHttpClient client = HttpClients.createDefault();
HttpGet httpGet = new HttpGet(url);
HttpResponse httpResponse;
try {
    // 该行代码发起网络请求
    httpResponse = client.execute(httpGet);

1
2

URLConnection urlConnection = url.openConnection();
HttpURLConnection urlConnection = url.openConnection();

1
2
3
4
5

HttpClient.execute
HttpClient.executeMethod
HttpURLConnection.connect
HttpURLConnection.getInputStream
URL.openStream

1
2
3
4
5
6
7
8
9
10
11
12

@GET
@Path("/images/{image}")
@Produces("images/*")
public Response getImage(@javax.ws.rs.PathParam("image") String image) {
    File file = new File("resources/images/", image); //Weak point

    if (!file.exists()) {
        return Response.status(Status.NOT_FOUND).build();
    }

    return Response.ok().entity(new FileInputStream(file)).build();
}

1
2
3
4
5
6
7
8

def getWordList(value:String) = Action {
  if (!Files.exists(Paths.get("public/lists/" + value))) {
    NotFound("File not found")
  } else {
    val result = Source.fromFile("public/lists/" + value).getLines().mkString // Weak point
    Ok(result)
  }
}

1
2
3
4

file file = new File(getExternalFilesDir(TARGET_TYPE), filename);
fos = new FileOutputStream(file);
fos.write(confidentialData.getBytes());
fos.flush();

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

import java.io.*;
public class DirList {
    public static void main(String[] args) {
        String dir = System.getProperty(“dir”);
        Process process = null;
        InputStream istream = null;
        try {
            process = Runtime.getRuntime().exec("cmd.exe /c dir" + dir);
            int result = process.waitFor();
            if (result != 0) {
                System.out.println("process error: " + result);
            }
            istream = (result == 0) ? process.getInputStream() : process.getErrorStream();
            byte[] buffer = new byte[512];
            while (istream.read(buffer) != -1) {
                System.out.print(new String(buffer, “gb2312”));
            }
        } catch (IOException e1) {
            e1.printStackTrace();
        } catch (InterruptedException e2) {
            e2.printStackTrace();
        } finally {
            if (istream != null) {
                try {
                    istream.close();
                } catch (IOException e) {
                    e.printStackTrace();
                }
            }
            if (process != null) {
                process.destroy();
            }
        }
    }
}

1

java -Ddir="..\\ & whoami

1
2
3
4
5
6
7
8
9
10
11

服务端直接存在可执行函数（exec()等），且对传入的参数过滤不严格导致 RCE 漏洞

服务端不直接存在可执行函数（exec()等），且对传入的参数过滤不严格导致 RCE 漏洞

由表达式注入导致的RCE漏洞，常见的如：OGNL、SpEL、MVEL、EL、Fel、JST+EL等

由java后端模板引擎注入导致的 RCE 漏洞，常见的如：Freemarker、Velocity、Thymeleaf等

由java一些脚本语言引起的 RCE 漏洞，常见的如：Groovy、JavascriptEngine等

由第三方开源组件引起的 RCE 漏洞，常见的如：Fastjson、Shiro、Xstream、Struts2、weblogic等

1
2
3
4

https://xz.aliyun.com/t/3372
https://xz.aliyun.com/t/3460
https://xz.aliyun.com/t/3416
https://xz.aliyun.com/t/3358