// 객체클래스
public class Greeting {
	private long id;
	private String content;
	public long getId() {
		return id;
	}
	public void setId(long id) {
		this.id = id;
	}
	public String getContent() {
		return content;
	}
	public void setContent(String content) {
		this.content = content;
	}
}

//컨트롤러
@Controller
public class HelloController {
    @GetMapping("/greeting")
    public String greetingForm(Model model) {
        model.addAttribute("greeting", new Greeting());
        return "hello";
    }
    @PostMapping("/greeting")
    public String greetingSubmit(@ModelAttribute Greeting greeting, Model model) {
        return "hello";
    }
}

docker build . -t spring4shell && docker run -p 8080:8080 spring4shell

python exploit.py --url "http://localhost:8080/helloworld/greeting"

$ find -name shell.jsp
./usr/local/tomcat/webapps/ROOT/shell.jsp

public class CheckSpringVersion{
	@Test
	public void versionTest() throws Exception{
		String test=org.springframework.core.SpringVersion.getVersion();
		System.out.println(test);
	}
}

import org.springwork.core.Ordered;
import org.springwork.core.annotation.Order;
import org.springwork.web.bind.WebDataBinder;
import org.springwork.web.bind.annotation.ControllerAdvice;
import org.springwork.web.bind.annotation.InitBinder;
 
@ControllerAdvice
@Order(10000)
public class BinderControllerAdvice {
	@InitBinder
	public setAllowedFields(WebDataBinder dataBinder) {
		String[] denylist = new String[]{"class.*", "Class.*", "*.class.*", "*.Class.*"};
		dataBinder.setDisallowedFields(denylist);
	}
}