Description
Actuator是Spring Boot提供的服务监控和管理中间件，当 /env、/refresh 端点允许POST方式进行访问，且目标使用 com.h2database.h2 时存在远程命令执行漏洞。
SpringBoot h2 database 远程命令执行
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://zgao.top/spring-boot-actuator-h2-%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0-poc%E4%BC%98%E5%8C%96%E8%A7%A3%E5%86%B3%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C/
https://nosec.org/m/share/3926.html
https://jkme.github.io/2022/03/18/from-spring-boot-to-getshell.html
https://cloud.tencent.com/developer/article/1676206
https://www.leavesongs.com/PENETRATION/talk-about-h2database-rce.html
https://www.cnblogs.com/shineman-zhang/articles/16753095.html
https://github.com/LandGrey/SpringBootVulExploit
https://wiki.96.mk/Web%E5%AE%89%E5%85%A8/Spring%20Boot/Spring%20Boot%20h2%20database%20query%20rce/
https://spaceraccoon.dev/remote-code-execution-in-three-acts-chaining-exposed-actuators-and-h2-database/
https://jfrog.com/blog/the-jndi-strikes-back-unauthenticated-rce-in-h2-database-console/
https://www.exploit-db.com/exploits/45506
https://www.sentinelone.com/vulnerability-database/cve-2021-42392/