Description
VMware Spring Cloud Data Flow是美国威睿（VMware）公司的一款用于微服务中流式处理和批处理数据的代码库。 VMware Spring Cloud Data Flow 2.11.0版本至2.11.3版本存在安全漏洞，该漏洞源于有权访问服务器API的恶意用户可以使用特制请求将任意文件写入文件系统上的任何位置。
Spring Cloud Data Flow 远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://spring.io/security/cve-2024-37084
https://www.venustech.com.cn/new_type/aqtg/20240725/27759.html
https://cn-sec.com/archives/3000529.html
https://blog.securelayer7.net/spring-cloud-data-flow-exploit/
https://github.com/advisories/GHSA-p528-3mvf-gr87
https://zhi.oscs1024.com/42938.html
https://cloud.tencent.com/developer/article/2428577
https://securityonline.info/cve-2024-37084-cvss-9-8-remote-code-execution-in-spring-cloud-data-flow/
https://www.secevery.com/toBugInfo?id=1816656656109576194