SpringCloudFunction-Research

SpringCloudFunction-Research CVE-2022-22963 research Environment vulfocus/spring-cloud-function-rce:latest Cause Parsing issue of the spring.cloud.function.routing-expression parameter in the Request Header, leading to injection Payload attacks. Reference...

CVE-2022-22963

CVE-2022-22963 - Spring4shell To run the vulnerable SpringBoot application run this docker container exposing it to port 8080. Example: root@kitploit: docker run -it -d -p 8080:8080 bobcheat/springboot-public Exploit Curl command: root@kitploit: curl -i -s -k -X $'POST' -H $'Host: 192.168.1.2:808...

CVE-2022-22963-Exploit

CVE-2022-22963 Exploit This repository contains a Rust-based exploit for the CVE-2022-22963 vulnerability found in Spring Cloud Function versions 3.1.6, 3.2.2, and older unsupported versions. The vulnerability allows remote code execution and access to local resources through a specially crafted...

SpEL

SpEL Batch detection tool for Spring Cloud Gateway Actuator API SpEL expression injection command execution CVE-2022-22947 Usage Write the URLs to be tested line by line in a file. Use parameter -TF to specify the file, and -t for concurrency count. Execution Result Yutu Security is committed to...

CVE-2017-8046

DISCLAIMER: This repository is supplementary to the VGS blog post, How to Avoid "Using Components with Known Vulnerabilities". It contains an application with a known security vulnerability namely, CVE-2017-8046, as well as the description of how to exploit it. Use the application at your own ris...

cve-2022-22963

Spring Cloud Function SpEL - cve-2022-22963 Build root@kitploit: $ git clone https://github.com/twseptian/cve-2022-22963.git $ cd cve-2022-22963 $ docker build . -t spring-spel-0day $ docker run -p 8080:8080 --name spring-spel-0day spring-spel-0day Payload root@kitploit:...

CVE-2022-22980

CVE-2022-22980 Spring Data MongoDB SpEL Expression Injection MongoDB is a document-oriented NoSQL database with the scalable and flexible that used for high volume data storage. Instead of using tables and rows as in the traditional relational databases, MongoDB makes use of collections and...

CVE-2026-22738

CVE-2026-22738 Reproduction Environment Vulnerability Description CVE-2026-22738 is a SpEL Spring Expression Language injection vulnerability in Spring AI SimpleVectorStore that can lead to unauthenticated remote code execution RCE. Affected Versions...

CVE-2026-22738-POC

CVE-2026-22738 — SpEL Injection RCE in Spring AI SimpleVectorStore Unauthenticated remote code execution via Spring Expression Language SpEL injection in SimpleVectorStore.similaritySearch. Affected Versions | Flag | Default | Description | |---|---|---| | --target | http://localhost:8082 | Base...

spinnaker-poc

Spinnaker Vulnerability POCs Proof-of-concept demonstrations for CVE-2026-32604 and CVE-2026-32613, two 10.0 severity vulnerabilities in Spinnaker that allow for code execution and production cloud credential theft. Video walkthrough of how to use these POCS Technical blog with more details...

CVE-2025-41243-Vulnerability-Lab

CVE-2025-41243: Spring Cloud Gateway RCE Lab Vulnerability Description Spring Cloud Gateway has a SpEL expression injection vulnerability. When the Actuator endpoint is enabled, an attacker can achieve remote code execution RCE. How to Start docker-compose up -d Reproduction 1. Access...

CVE-2020-5245

CVE-2020-5245 1. Run mvn clean install to build your application 2. Start application with java -jar target/dropwizard-1.0-SNAPSHOT.jar server config.yml 3. To check that your application is running enter url http://localhost:8080 some error in pom.xml plugins were not affected reproduce Reproduc...

cve-2022-22947

Spring Cloud Gateway Actuator API SpEL Code Injection CVE-2022-22947 Build root@kitploit: $ git clone https://github.com/twseptian/cve-2022-22947.git $ cd cve-2022-22947 $ docker build . -t cve-2022-22947 $ docker run -p 9000:9000 --name cve-2022-22947 cve-2022-22947 PoC send the following reques...

CVE-2022-22963

CVE-2022-22963 CVE-2022-22963 PoC Slight modified for English translation and detection of https://github.com/chaosec2021/Spring-cloud-function-SpEL-RCE/blob/main/SpelRCEPOC.py . By default whoami is executed on the target and a file vulnerable.txt is created with the URLs that are vulnerable. Mo...

cve-2022-22947

cve-2022-22947 Spring Cloud Gateway is an API gateway in Spring. Versions 3.1.0 and 3.0.6 inclusive and earlier contain a SpEL expression injection vulnerability. When an attacker can access the Actuator API, they can exploit this vulnerability to execute arbitrary commands. Usage: root@kitploit:...

Spring_cve-2022-22980

Springcve-2022-22980 spring data mongodb remote code execution | cve-2022-22980 poc Description A Spring Data MongoDB application is vulnerable to SpEL injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value...

CVE-2020-10199

CVE-2020-10199 Previously, during a penetration test, I encountered a target environment that had Nexus Repository Manager deployed. After stepping on some pitfalls, I finally managed to get a shell. I'll make a brief record here so it's easier to review later if needed. Target version: Sonatype...

CVE-2022-22963

CVE-2022-22963 En las versiones 3.1.6, 3.2.2 y versiones anteriores de Spring Cloud Function, al utilizar la funcionalidad de enrutamiento es posible que un usuario proporcione un SpEL especialmente diseñado como una expresión de enrutamiento que puede resultar en la ejecución remota de código y ...

cve-2022-22980

spring-data-mongodb-cve-2022-22980-exp A mediocre vulnerability, just making a note. 1. Start Redis, port 27017 2. Start the project, SpringBoot starts on port 6666 3. root@kitploit: GET /v1/user/get?username=Tjava.lang.Runtime.getRuntime.exec'open+-a+calculator.app' HTTP/1.1 Host: localhost:6666...

Spring-Data-Mongodb-Example

Spring-Data-Mongodb-Example CVE-2022-22980 environment Build docker environment root@kitploit: docker build -t mongo . docker run -dit -p 6666:6666 mongo PoC root@kitploit: ➜ Spring-Data-Mongodb-Example git:main curl 0:6666/v1/user/get -d 'id=Tjava.lang.Runtime.getRuntime.exec"touch /tmp/aaaa"'...