Description
Actuator是Spring Boot提供的服务监控和管理中间件，当 /env、/restart 端点允许POST方式进行访问，通过修改logging.config 属性的值可能触发远程命令执行漏洞。
SpringBoot spring.main.sources 属性存在远程命令执行
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/LandGrey/SpringBootVulExploit
https://www.hm-zy.cn/?p=98
https://r0yanx.com/2021/04/29/Spring-Boot-Vulnerability-Exploit-Check-List/
https://0xn3va.gitbook.io/cheat-sheets/framework/spring/spring-boot-actuators
https://juejin.cn/post/7468505344228098048
https://devpress.csdn.net/v1/article/detail/144642829