References https://blog.csdn.net/weixin_39190897/article/details/135232151 https://github.com/Threekiii/Vulnerability-Wiki/blob/master/docs-base/docs/webapp/XXL-JOB-executor-%E6%9C%AA%E6%8E%88%E6%9D%83%E8%AE%BF%E9%97%AE%E6%BC%8F%E6%B4%9E.md https://www.cnblogs.com/LittleHann/p/17814440.html https://www.ksyun.com/cms/notice/177.html https://r17a-17.github.io/2020/10/30/XXL-job%E4%BB%BB%E5%8A%A1%E8%B0%83%E5%BA%A6%E5%B9%B3%E5%8F%B0-%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0/ https://x.threatbook.com/v5/article?threatInfoID=96052 https://www.cnvd.org.cn/flaw/show/CNVD-2019-27712 https://zhuanlan.zhihu.com/p/32990088218 https://github.com/xuxueli/xxl-job/issues/3333 https://nvd.nist.gov/vuln/detail/CVE-2023-48089
Related VulnerabilitiesPoCCVE-2020-23814: XXL-JOB v2.2.0 — Stored Cross Site ScriptingPoCxxljob-default-login: XXL-JOB Default LoginPoCxxl-job-default-token-bypass-rce: XXL-JOB 默认 accessToken 身份绕过漏洞PoCxxljob-executor-unauth: XXL-JOB executor - Unauthorized AccessXXL-JOB Executor /run 代码执行漏洞XXL-JOB 任务调度中心 后台任意命令执行漏洞xxl-job api未授权Hessian2反序列化漏洞XXL-JOB api未授权访问漏洞分布式任务调度平台XXL-JOB权限绕过漏洞XXL-JOB默认accessToken身份绕过RCE漏洞