Description
AJ-Report是anji-plus开源的一个可视化设计工具。 AJ-Report 1.4.1之前版本存在安全漏洞，该漏洞源于远程未经身份验证的攻击者可以将swagger-ui附加到HTTP请求中以绕过身份验证并在受害服务器上执行任意Java。
AJ-Report 权限绕过致远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/Threekiii/Vulnerability-Wiki/blob/master/docs-base/docs/webapp/AJ-Report-%E8%AE%A4%E8%AF%81%E7%BB%95%E8%BF%87%E4%B8%8E%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E-CNVD-2024-15077.md
https://blog.csdn.net/weixin_57443487/article/details/141281559
https://www.cnblogs.com/Rainy-Day/p/18220776
https://cloud.tencent.com/developer/article/2419692
https://vulncheck.com/advisories/aj-report-swagger
https://cn-sec.com/archives/2773446.html
https://nvd.nist.gov/vuln/detail/CVE-2024-7314