The project has a shiro deserialization vulnerability

[qxlsl1]

1、First, set up a local service and ensure that it can run properly
Find its background login address

2、We can see that remeberMe cipherKey has been written in the source code

3、Inspect the shiro frame using the shiro Blasting tool

4、Once the cipherKey is specified, blow up shiro's utilization chain

5、Discover the construction chain :CommonsBeanutilsString_183 The command output mode is AllEcho
6、The whoami command was successfully executed, confirming the existence of the vulnerability

7、Tool link：https://github.com/SummerSec/ShiroAttack2

[gg110]

您好！您的邮件已收到，我会尽快回复！祝生活愉快！