CVE-2022-22965

CVE 2022-22965Spring4Shell 分析 漏洞描述 Spring4Shell 是存在于 Spring Framework 的 Spring Core 上的一个 CVE 的名称。 其 CVSS 3.x 评分为 9.8，该漏洞被列为最高风险等级（critical）。该漏洞允许攻击者远程执行利用代码并控制存在漏洞的服务器。 鉴于 Spring Core 在互联网上的普及程度以及 Spring4Shell 的严重影响，专家们评估该漏洞的影响力不亚于 Log4shell。 影响范围 Spring4Shell 并不会影响互联网上所有使用 Spring Framework 的 Web...

cve-2023-50164-poc

CVE-2023-50164 の PoC インストール このツールをインストールするには、Go バージョン 1.20 以上がインストールされ、設定されている必要があります。 $ go install github.com/dwisiswant0/cve-2023-50164-poc@latest または、以下のように自分でコンパイルすることもできます： $ git clone http://github.com/dwisiswant0/cve-2023-50164-poc cve-2023-50164-poc/ $ cd $ $ go build . 仕組み...

Spring4Shell-POC

Spring4Shell-POC Spring4Shell 脆弱性のローカル再現手順 環境準備 環境 docker、docker-compose mvn パッケージングにより、./target/ROOT.war を生成shell mvn package root@kitploit: サービス起動shell docker-compose up -d サービスの停止shell docker-compose down root@kitploit: 再現手順 スクリプトを実行shell python3 spring-4-shell-exp.py --url...

CVE-2023-50164-Apache-Struts-RCE

Contains vulnerable WAR file and docker file that can be used to test CVE-2023-50164-Apache-Struts-RCE. This dockerfile and vulnerable application is compiled and designed using resources and code from https://github.com/jakabakos/CVE-2023-50164-Apache-Struts-RCE. Thanks to him for such a detaile...

spring-core-rce

spring-core-rce spring core rce の簡単な利用方法 warファイルは以下を使用可能 https://github.com/fengguangbin/spring-rce-war docker環境は以下を使用可能 https://github.com/lunasec-io/Spring4Shell-POC vulfocusのオンライン環境も使用可能 http://vulfocus.io/ またはvulhubのターゲット環境 https://github.com/vulhub/vulhub/tree/master/spring/CVE-2022-22965...

spring4shell-poc

Spring4Shell POC Description of the vulnerability: https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html Construction of the POC: https://github.com/BobTheShoplifter/Spring4Shell-POC Steps to Build/Run Tested with JDK 11.0.14, Spring Boot 2.6.5, and Apache Tomcat 9.0.60 Run...

CVE-2020-1938-Exploitation

CVE-2020-1938 悪用 Apache Tomcat における任意のJSPアップロードからRCEに至る脆弱性 説明 CVE-2020-1938 は、Apache Tomcat のバージョン 9.0.0.M1 から 9.0.0.30、8.5.0 から 8.5.50、および 7.0.0 から 7.0.99 に影響する重大な脆弱性です ⚠️ これは Hack The Box のラボで悪用されました。 🔗 参考: NIST NVD エントリ 偵察 攻撃ベクトルの特定 1. ウェブサイトでは Server Status 機能にデフォルトの認証情報が使用されている。 2...

CVE-2024-23897

CVE-2024-23897 環境構築 1. Java インストール sudo apt update sudo apt install openjdk-11-jdk -y 2. Jenkins WARファイルのダウンロード wget https://get.jenkins.io/war/2.441/jenkins.war 3. デフォルトJavaバージョンの変更 - Java 11を選択 sudo update-alternatives --config java 4. バージョン確認 - openjdk version "11.x.x" 確認 java -version 5...

CVE-2026-20127_EXP

CVE-2026-20127EXP Cisco Catalyst SD-WAN 身份验证绕过漏洞CVE-2026-20127漏洞利用EXP 基础用法 python scan.py -f targets.txt 显示详细信息 python scan.py -f targets.txt -v 调整线程数并保存结果 python scan.py -f targets.txt -t 10 -o vulnerable.txt 指定WAR文件路径 python scan.py -f targets.txt -w cmd.war 指定WAR文件路径调整线程并保存结果 python scan.py -f...

inspec-log4j

inspec-log4j 此配置文件直接在文件系统以及嵌入在WAR文件中扫描易受攻击的Log4j Core JAR文件版本。 在本地运行配置文件 root@kitploit: git clone https://github.com/trickyearlobe/inspec-log4j inspec exec inspec-log4j 针对远程SSH目标运行配置文件 确保目标上已为特权用户（如root）加载SSH密钥。 或者，查看CLI文档，了解如何使用Inspec与SUDO。 root@kitploit: git clone...

Java-Servlets-Shell

Java Servlets Shell Backdoor de Java Servlets inspirado en https://www.redteam-pentesting.de/files/redteam-jboss.tar.gz Nota : Los WAR contienen código Java compilado en lugar de páginas JSP para poder utilizarse en entornos que bloquean o no compilan archivos JSP...

PT-2023-8926 · Sysaid · Sysaid

Name of the Vulnerable Software and Affected Versions: SysAid affected versions not specified Description: The issue is related to a path traversal vulnerability in the doPost method of the com.ilient.server.UserEntry class in SysAid, a service support and hardware and software control automation...

Hackers Target Apache Tomcat Servers for Mirai Botnet and Crypto Mining

Misconfigured and poorly secured Apache Tomcat servers are being targeted as part of a new campaign designed to deliver the Mirai botnet malware and cryptocurrency miners. The findings come courtesy of Aqua, which detected more than 800 attacks against its Tomcat server honeypots over a two-year...

CVE-2023-33247

Talend Data Catalog remote harvesting server before 8.0-20230413 contains a /upgrade endpoint that allows an unauthenticated WAR file to be deployed on the server. A mitigation is that the remote harvesting server should be behind a firewall that only allows access to the Talend Data Catalog serv...

CVE-2023-33247

Talend Data Catalog remote harvesting server before 8.0-20230413 contains a /upgrade endpoint that allows an unauthenticated WAR file to be deployed on the server. A mitigation is that the remote harvesting server should be behind a firewall that only allows access to the Talend Data Catalog serv...

GHSA-F5WX-W2F9-82GH XXE vulnerability in Jenkins WebSphere Deployer Plugin

WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XML external entity XXE attacks. This could be exploited by a user with Job/Configure permissions to upload a specially crafted war file containing a WEB-INF/ibm-web-ext.xml which is parsed by the plugin...

GHSA-W47G-4VRC-M3W2 Cross-site Scripting in Apache Pluto Chatroom demo

The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting XSS attacks. Mitigation: Uninstall the ChatRoomDemo war file - or - migrate to version 3.1.0 of the chat-room-demo war file...

GHSA-GGX9-4728-588R Apache Tomcat Directory Traversal vulnerability

Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. dot dot in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry...

Apache Tomcat Directory Traversal vulnerability

Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. dot dot in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry...

Spring4Shell (CVE-2022-22965): details and mitigations

Last week researchers found the critical vulnerability CVE-2022-22965 in Spring – the open source Java framework. Using the vulnerability, an attacker can execute arbitrary code on a remote web server, which makes CVE-2022-22965 a critical threat, given the Spring frameworks popularity. By analog...