CVE-2020-10199

CVE-2020-10199 Previously, during a penetration test, I encountered a target environment that had Nexus Repository Manager deployed. After stepping on some pitfalls, I finally managed to get a shell. I'll make a brief record here so it's easier to review later if needed. Target version: Sonatype...

Spring-CVE

Spring CVE This includes CVE-2022-22963, a Spring SpEL / Expression Resource Access Vulnerability, as well as CVE-2022-22965, the spring-webmvc/spring-webflux RCE termed "SpringShell". CVE-2022-22963 In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing...

CVE-2022-22947

CVE-2022-22947 Spring Cloud Gateway is an API gateway in Spring. Versions 3.1.0 and 3.0.6 inclusive and earlier have a SpEL expression injection vulnerability. If an attacker can access the Actuator API, they can exploit this vulnerability to execute arbitrary commands. Vulnerability Environment...

Spring-Data-Mongodb-Example

Spring-Data-Mongodb-Example CVE-2022-22980 environment Build docker environment docker build -t mongo . docker run -dit -p 6666:6666 mongo PoC ➜ Spring-Data-Mongodb-Example git:main curl 0:6666/v1/user/get -d 'id=Tjava.lang.Runtime.getRuntime.exec"touch /tmp/aaaa"'...

CVE-2022-22947

Spring Cloud Gateway Actuator API SpEL Expression Injection Command Execution CVE-2022-22947 Spring Cloud Gateway Actuator API SpEL Code Injection CVE-2022-22947 Usage: -t http://vuldomain.com // single IP -f urls.txt // read file for batch scan, multi-threaded, fast -c command // custom command,...

CVE-2026-22738

CVE-2026-22738 Reproduction Environment Vulnerability Description CVE-2026-22738 is a SpEL Spring Expression Language injection vulnerability in Spring AI SimpleVectorStore that can lead to unauthenticated remote code execution RCE. Affected Versions Artifact| Affected Versions| Fixed Versions...

SpringCloudFunction-Research

SpringCloudFunction-Research CVE-2022-22963 research Environment vulfocus/spring-cloud-function-rce:latest Cause Parsing issue of the spring.cloud.function.routing-expression parameter in the Request Header, leading to injection Payload attacks. Reference...

CVE-2024-37759_PoC

CVE-2024-37759 PoC Description DataGear version 5.0.0 and earlier has a SpEL expression injection vulnerability that leads to remote code execution. Exploit CVE Exploit Details When you request the /data/schemaId/tableName/view interface, if the database table does not have a primary key, an...

cve-2022-22963

Spring Cloud Function SpEL - cve-2022-22963 Build $ git clone https://github.com/twseptian/cve-2022-22963.git $ cd cve-2022-22963 $ docker build . -t spring-spel-0day $ docker run -p 8080:8080 --name spring-spel-0day spring-spel-0day Payload...

CVE-2022-22963-POC

CVE-2022-22963 Exploit Description In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local...

CVE-2022-22947-pb-ai

CVE-2022-22947 Spring Cloud Gateway Vulnerability Verification Application This is a Spring Cloud Gateway application specifically designed to demonstrate and verify the CVE-2022-22947 vulnerability. The application uses a vulnerable version of Spring Cloud Gateway and allows arbitrary code...

CVE-2022-22963

CVE-2022-22963 spring cloud function spel rce spring cloud function one-click exploitation tool! by charis Blog https://charis3306.top/ Packaged as an exe file, ready to use out of the box Command theme usage: Spring-cloud-function-spel0.2.exe -h --check CHECK --route ROUTE --url URL --ip IP --po...

CVE-2022-22947-

CVE-2022-22947 Spring Cloud Gateway Actuator API SpEL expression injection command execution（CVE-2022-22947） Inject Godzilla memory shell Default key pass base64 Note: the code does not clear the route part, please clear it yourself.. Test environment:...

Spring_cve-2022-22980

Springcve-2022-22980 spring data mongodb remote code execution | cve-2022-22980 poc Description A Spring Data MongoDB application is vulnerable to SpEL injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value...

cve-2022-22947

Spring Cloud Gateway Actuator API SpEL Code Injection CVE-2022-22947 Build $ git clone https://github.com/twseptian/cve-2022-22947.git $ cd cve-2022-22947 $ docker build . -t cve-2022-22947 $ docker run -p 9000:9000 --name cve-2022-22947 cve-2022-22947 PoC send the following request to add a rout...

CVE-2022-22980

CVE-2022-22980 Spring Data MongoDB SpEL Expression Injection MongoDB is a document-oriented NoSQL database with the scalable and flexible that used for high volume data storage. Instead of using tables and rows as in the traditional relational databases, MongoDB makes use of collections and...

spinnaker-poc

Spinnaker Vulnerability POCs Proof-of-concept demonstrations for CVE-2026-32604 and CVE-2026-32613, two 10.0 severity vulnerabilities in Spinnaker that allow for code execution and production cloud credential theft. Video walkthrough of how to use these POCS Technical blog with more details...

cve-2022-22980

spring-data-mongodb-cve-2022-22980-exp A mediocre vulnerability, just making a note. 1. Start Redis, port 27017 2. Start the project, SpringBoot starts on port 6666 3. GET /v1/user/get?username=Tjava.lang.Runtime.getRuntime.exec'open+-a+calculator.app' HTTP/1.1 Host: localhost:6666 Accept-Encodin...

CVE-2022-22963

CVE-2022-22963 Educational proof-of-concept automation for CVE-2022-22963, demonstrated in an authorized Hack The Box lab environment. Overview CVE-2022-22963 is a Spring Cloud Function vulnerability involving the spring.cloud.function.routing-expression header. Under vulnerable configurations, a...

cve-2022-22947

cve-2022-22947 Spring Cloud Gateway is an API gateway in Spring. Versions 3.1.0 and 3.0.6 inclusive and earlier contain a SpEL expression injection vulnerability. When an attacker can access the Actuator API, they can exploit this vulnerability to execute arbitrary commands. Usage: ➜...