CVE-2020-1938-Exploitation

CVE-2020-1938 Exploitation Apache Tomcat arbitrary JSP upload leading to RCE Description CVE-2020-1938 is a critical vulnerability which impacts Apache Tomcat from 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 ⚠️ This was exploited in a Hack The Box lab. 🔗 Reference: NIST NVD Entry...

CVE-2024-23897

CVE-2024-23897 Environment Setup 1. Install Java sudo apt update sudo apt install openjdk-11-jdk -y 2. Download Jenkins WAR file wget https://get.jenkins.io/war/2.441/jenkins.war 3. Change default Java version - Select Java 11 sudo update-alternatives --config java 4. Verify version - Check...

CVE-2022-22965

CVE-2022-22965 Spring4Shell Analysis Vulnerability Description Spring4Shell is the name of a CVE existing on Spring Core of the Spring Framework. With a CVSS 3.x score of 9.8, the vulnerability is classified as the highest risk level critical. This vulnerability allows an attacker to execute remo...

cve-2023-50164-poc

PoC for CVE-2023-50164 Install To install this tool you must have Go version at least 1.20 installed and configured. $ go install github.com/dwisiswant0/cve-2023-50164-poc@latest Alternatively, you can compile it by DIY: $ git clone http://github.com/dwisiswant0/cve-2023-50164-poc...

Spring4Shell-POC

Spring4Shell-POC Local reproduction process of Spring4Shell vulnerability Environment Preparation Environment: docker, docker-compose mvn package, generate ./target/ROOT.warshell mvn package root@kitploit: Start the serviceshell docker-compose up -d Stop serviceshell docker-compose down...

CVE-2023-50164-Apache-Struts-RCE

Contains vulnerable WAR file and docker file that can be used to test CVE-2023-50164-Apache-Struts-RCE. This dockerfile and vulnerable application is compiled and designed using resources and code from https://github.com/jakabakos/CVE-2023-50164-Apache-Struts-RCE. Thanks to him for such a detaile...

spring-core-rce

spring-core-rce spring core rce simple exploitation A war file is available at https://github.com/fengguangbin/spring-rce-war For Docker environment, you can use https://github.com/lunasec-io/Spring4Shell-POC You can also use the online environment at http://vulfocus.io/ or the vulhub vulnerable...

spring4shell-poc

Spring4Shell POC Description of the vulnerability: https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html Construction of the POC: https://github.com/BobTheShoplifter/Spring4Shell-POC Steps to Build/Run Tested with JDK 11.0.14, Spring Boot 2.6.5, and Apache Tomcat 9.0.60 Run...

CVE-2026-20127_EXP

CVE-2026-20127EXP Cisco Catalyst SD-WAN Authentication Bypass Vulnerability CVE-2026-20127 Exploit EXP Basic Usage python scan.py -f targets.txt Display Detailed Information python scan.py -f targets.txt -v Adjust Thread Count and Save Results python scan.py -f targets.txt -t 10 -o vulnerable.txt...

inspec-log4j

inspec-log4j This profile scans for vulnerable versions of Log4j Core JAR files directly on the file system, and embedded in WAR files. Running the profile locally root@kitploit: git clone https://github.com/trickyearlobe/inspec-log4j inspec exec inspec-log4j Running the profile against a remote...

Java-Servlets-Shell

Java Servlets Shell Java Servlets Backdoor inspired by https://www.redteam-pentesting.de/files/redteam-jboss.tar.gz Note : The WARs contain compiled Java code instead of JSP pages in order to be used in environments that block or do not compile JSP files...

PT-2023-8926 · Sysaid · Sysaid

Name of the Vulnerable Software and Affected Versions: SysAid affected versions not specified Description: The issue is related to a path traversal vulnerability in the doPost method of the com.ilient.server.UserEntry class in SysAid, a service support and hardware and software control automation...

Hackers Target Apache Tomcat Servers for Mirai Botnet and Crypto Mining

Misconfigured and poorly secured Apache Tomcat servers are being targeted as part of a new campaign designed to deliver the Mirai botnet malware and cryptocurrency miners. The findings come courtesy of Aqua, which detected more than 800 attacks against its Tomcat server honeypots over a two-year...

CVE-2023-33247

Talend Data Catalog remote harvesting server before 8.0-20230413 contains a /upgrade endpoint that allows an unauthenticated WAR file to be deployed on the server. A mitigation is that the remote harvesting server should be behind a firewall that only allows access to the Talend Data Catalog serv...

CVE-2023-33247

Talend Data Catalog remote harvesting server before 8.0-20230413 contains a /upgrade endpoint that allows an unauthenticated WAR file to be deployed on the server. A mitigation is that the remote harvesting server should be behind a firewall that only allows access to the Talend Data Catalog serv...

GHSA-F5WX-W2F9-82GH XXE vulnerability in Jenkins WebSphere Deployer Plugin

WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XML external entity XXE attacks. This could be exploited by a user with Job/Configure permissions to upload a specially crafted war file containing a WEB-INF/ibm-web-ext.xml which is parsed by the plugin...

GHSA-W47G-4VRC-M3W2 Cross-site Scripting in Apache Pluto Chatroom demo

The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting XSS attacks. Mitigation: Uninstall the ChatRoomDemo war file - or - migrate to version 3.1.0 of the chat-room-demo war file...

Apache Tomcat Directory Traversal vulnerability

Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. dot dot in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry...

GHSA-GGX9-4728-588R Apache Tomcat Directory Traversal vulnerability

Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. dot dot in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry...

Spring4Shell (CVE-2022-22965): details and mitigations

Last week researchers found the critical vulnerability CVE-2022-22965 in Spring – the open source Java framework. Using the vulnerability, an attacker can execute arbitrary code on a remote web server, which makes CVE-2022-22965 a critical threat, given the Spring frameworks popularity. By analog...