Description
Spring Boot Jolokia 是一个用于管理和监控 Spring Boot 应用程序的开源库。Jolokia（Java + OSGi + JMX + JSON）是一个为Java应用程序提供远程JMX（Java Management Extensions）访问的框架。Spring Boot Jolokia 存在远程代码漏洞
SpringBoot Actuator Jolokia 远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://wiki.96.mk/Web%E5%AE%89%E5%85%A8/Spring%20Boot/Spring%20Boot%20Actuator%20jolokia%20%E9%85%8D%E7%BD%AE%E4%B8%8D%E5%BD%93%E5%AF%BC%E8%87%B4%E7%9A%84rce%E6%BC%8F%E6%B4%9E/
https://forum.90sec.com/t/topic/644
https://github.com/flowerlake/spring-jolokia-rce
https://blog.csdn.net/guo15890025019/article/details/129594714
https://zone.huoxian.cn/d/250-spring-actuatorjolokiarce
https://hacktricks.wiki/en/network-services-pentesting/pentesting-web/spring-actuators.html
https://beaglesecurity.com/blog/vulnerability/spring-boot-actuators-xxe.html
https://www.veracode.com/blog/research/exploiting-spring-boot-actuators
https://j1anfen.github.io/%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0/Spring%20Boot%20Actuators%E9%85%8D%E7%BD%AE%E4%B8%8D%E5%BD%93%E5%AF%BC%E8%87%B4RCE%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0/