Description
Apache Axis 是一个开源的SOAP（Simple Object Access Protocol）引擎，它可以在Java环境中实现跨平台和跨语言的Web服务。 Apache Axis 1.x 版本中ServiceFactory.getService 方法接收到不受信任的数据，可能会导致远程命令执行、SSRF、DOS的风险。
Apache Axis getService 方法存在远程命令执行
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://stack.chaitin.com/vuldb/detail/07a1dadd-9e72-4fc7-ab65-4c2191e1bc25
https://github.com/Threekiii/Vulnerability-Wiki/blob/master/docs-base/docs/middleware/Apache-Axis-%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E-CVE-2019-0227.md
http://nic.hitsz.edu.cn/info/1083/1291.htm
http://www.bmth666.cn/2023/11/28/Apache-Axis1-4-RCE-%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/index.html
https://avd.aliyun.com/detail?id=AVD-2019-0227
https://netc.shcmusic.edu.cn/2023/0907/c1811a48753/pagem.htm
https://comate.baidu.com/zh/page/7meq2t2gc3s
https://juejin.cn/post/6961396231306215432
https://www.secrss.com/articles/11504
https://www.cnblogs.com/0x28/p/14380450.html
https://zhuanlan.zhihu.com/p/137756274
https://nvd.nist.gov/vuln/detail/cve-2023-40743
https://www.sentinelone.com/vulnerability-database/cve-2023-40743/
https://rhinosecuritylabs.com/application-security/cve-2019-0227-expired-domain-rce-apache-axis/