database-spring-ENC

spring-ENC | sprint encode plan text get enc password Reference links: How to encrypt user passwords http://www.jasypt.org/howtoencryptuserpasswords.html 0x00 Introduction Jasypt stands for Java Simplified Encryption. It provides basic encryption of plain text, numbers, and binary files to protec...

CVE-2022-22965-PoC_Payara

CVE-2022-22965 PoC - Payara Arbitrary File Download Minimal example of how to reproduce CVE-2022-22965 Spring vulnerability in Payara/Glassfish. Alternative payload for Payara/Glassfish that allows the malicious user to set an arbitrary web root, leading to arbitrary file download. Run using dock...

CVE-2022-22965

CVE-2022-22965-POC CVE-2022-22965 spring-core batch detection script Disclaimer: This script is for learning purposes only. Prohibited for illegal use. If there is any malicious destruction or illegal use, it has nothing to do with me!!! Usage: python3 CVE-2022-22965-POC.py url.txt After successf...

CVE-2022-22978

CVE 2022-22978: Authorization Bypass in RegexRequestMatcher 🥶 Overview According to the information I have gathered, this vulnerability relates to the RegexRequestMatcher class in the Spring Security framework. Specifically, applications using RegexRequestMatcher where the regular expression...

log4shellpoc

Simple Spring Boot application vulnerable to CVE-2021-44228 Log4Shell This proof-of-concept application for CVE-2021-44228 a.k.a log4shell is a part of my writeup. For the complete exploit details, refer to the writeup. Instructions Run: docker run --rm -p 8080:8080 --name log4shell-poc-app...

CVE-2021-45105

tejas-nagchandi/CVE-2021-45105 Replicating CVE-2021-45105 API curl -I localhost:8080/currentDateTime -H 'Time-Zone: GMT' Output: Attack curl -I localhost:8080/currentDateTime -H 'Time-Zone: $$::-$::-$$::-$' Output: Logs: Reference: https://vulners.com/cve/CVE-2021-45105...

Log4Shell-PoC-Application

☕ Log4Shell PoC Application Spring framework based web application for proof of concept for log4shell vulnerabilities Install & Launch !Important JDK 1.88u131 in development is required to launch this project Use the provided Dockerfile to build and run the Docker image for poc application. docke...

boot-jackson-cve

Reproduction of CVE-2020-36518 in Spring Boot 2.5.10 Execute: ./mvnw clean verify It will fail with: ERROR Failed to execute goal org.owasp:dependency-check-maven:7.0.0:check default on project jackson-demo: ERROR ERROR One or more dependencies were identified with vulnerabilities that have a CVS...

spring-rce-poc

spring-rce-poc Testing CVE-2022-22968 Simple app vulnerable to CVE-2022-22968 Dockerfile could be used to build it on vulnerable version of Tomcat 9.0.59 exploit.sh is a shell script which is trying to exploit this cve on 8080 port of localhost If attack with exploit.sh was succesfull, on context...

CVE-2022-22965

CVE-2022-22965 CVE-2022-22965 EXP General environment requirements: 1. Whether Spring framework is used; if not, the vulnerability does not exist 2. Whether Spring parameter binding is used; if not, the vulnerability does not exist 3. The JDK version used by the middleware; if the version is lowe...

Spring4shell

Spring4shell Spring4shell...

CVE-2022-22965

CVE-2022-22965 Spring4Shell CVE-2022-22965 Usage 1. show info ❯ go run main.go -s INF VulnInfo: "Name": "CVE-2022-22965", "VulID": "nil", "Version": "1.0", "Author": "", "VulDate": "2022-03-30", "References": "https://nosec.org/home/detail/4983.html" , "AppName": "Spring Core", "AppPowerLink":...

spring-retry-toolkit

This project provides declarative retry support for Spring applications. It is used in Spring Batch, Spring Integration, and others. Imperative retry is also supported for explicit usage. Version The version fix spring-retry with 2.0.13 for java8 and spring4 or spring5, For more information, plea...

CVE-2020-5398

CVE-2020-5398 - RFDReflected File Download Attack for Spring MVC In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download RFD attack when it sets a “Content-Disposition” header...

CVE-2022-22978-demo

CVE-2022-22978-demo CVE-2022-22978 vulnerability demo code Exploitation Conditions Although rated as high severity, the exploitation conditions are quite stringent. Personally, I find this vulnerability rather underwhelming. 1. First, spring-security must be within the affected scope. 2. Second, ...

CVE-2022-22965

Spring Framework Remote Code Execution Vulnerability CVE-2022-22965 Analysis Code Analysis on BiliBili:https://www.bilibili.com/video/BV1jY4y1H7EC...

CVE-2026-40987

CVE-2026-40987: Spring Integration Remote File Synchronization Path Traversal PoC This repository is a minimal reproduction PoC for CVE-2026-40987, as disclosed in the official Spring Security Advisory. Official advisory: https://spring.io/security/cve-2026-40987/ Official title: Remote-file...

SpringBreakVulnerableApp

Spring Break Vulnerable Application This is a vulnerable application to test the exploit for the Spring Break vulnerability CVE-2017-8046. WARNING! This application contains serious security vulnerabilities. Run it at your own risk! It is recommended using a backed-up and sheltered environment su...

Spring-Cloud-Gateway-Nacos

This repository does not have a README...

SpringSource__spring-security-oauth_CVE-2018-1260_2-3-2-RELEASE

This project provides support for using Spring Security with OAuth 1a and OAuth2. It provides features for implementing both consumers and providers of these protocols using standard Spring and Spring Security programming models and configuration idioms. Code of Conduct This project adheres to th...