SpEL

SpEL Batch detection tool for Spring Cloud Gateway Actuator API SpEL expression injection command execution CVE-2022-22947 Usage Write the URLs to be tested line by line in a file. Use parameter -TF to specify the file, and -t for concurrency count. Execution Result Yutu Security is committed to...

CVE-2022-22947

CVE-2022-22947 A code injection attack on spring cloud gateway Summary of the CVE In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+, applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make ...

CVE-2021-21234

CVE-2021-21234 Directory traversal vulnerability in the spring-boot-actuator-logview library https://blogg.pwc.no/styringogkontroll/unauthenticated-directory-traversal-vulnerability-in-a-java-spring-boot-actuator-library-cve-2021-21234...

CVE-2022-22947

Spring Cloud Gateway 3.0.7 & 3.1.1 Code Injection RCE CVE: CVE-2022-22947 CVSS: 10.0 Vmware - https://tanzu.vmware.com/security/cve-2022-22947 Applications using Spring Cloud Gateway are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A...

CVE-2022-22947

Spring Cloud Gateway RCE Env CVE-2022-22947 CVE-2022-22947 was identified in the Spring Cloud Gateway Server jar. After the application is compiled you should be able to view the existing routes by visiting: http://127.0.0.1:9000/actuator/gateway/routes Compile root@kitploit: $ mvn package...

mad-metasploit

Metasploit custom modules, plugins, resource script and.. awesome metasploit collection https://www.hahwul.com/p/mad-metasploit.html Awesome open awesome.md Add mad-metasploit to metasploit framework...

CVE-2022-22947

CVE-2022-22947 root@kitploit: script for exploit Spring Cloud Gateway Actuator API SpEL Code Injection CVE-2022-22947 root@kitploit: https://github.com/march0s1as/CVE-2022-22947 cd CVE-2022-22947 go build spring.go ./spring -h...

Spring Cloud Gateway Server Webflux - Broken Access Control

Spring Cloud Gateway Server Webflux contains a vulnerability caused by unsecured and exposed actuator endpoints allowing modification of Spring Environment properties, letting attackers modify configuration, exploit requires unsecured actuator endpoints exposure. id: CVE-2025-41243 info: name:...

Versa Concerto Actuator Endpoint - Authentication Bypass

An authentication bypass vulnerability affected the Spring Boot Actuator endpoints in Versa Concerto due to improper handling of the X-Real-Ip header.Attackers could access restricted endpoints by omitting this header.The issue allowed unauthorized access to sensitive functionality, highlighting...

Spring Boot Actuator Logview Directory Traversal

spring-boot-actuator-logview before version 0.2.13 contains a directory traversal vulnerability in libraries that adds a simple logfile viewer as a spring boot actuator endpoint maven package "eu.hinsch:spring-boot-actuator-logview". id: CVE-2021-21234 info: name: Spring Boot Actuator Logview...

Spring Cloud Gateway Code Injection

Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote...

CVE-2022-22947_EXP

1. Spring Cloud Gateway Remote Code Execution Vulnerability Hazard Level: High POC/EXP: Public CNVD ID: CNNVD-2022-16402 CVE ID: CVE-2022-22947 2. Affected Versions: VMWare Spring Cloud GateWay 3.1.0 VMWare Spring Cloud GateWay =3.0.0, python cve-2022-22947.py 验证单个目标： 1、python cve-2022-22947.py...

cve-2022-22947

cve-2022-22947 Spring Cloud Gateway is an API gateway in Spring. Versions 3.1.0 and 3.0.6 inclusive and earlier contain a SpEL expression injection vulnerability. When an attacker can access the Actuator API, they can exploit this vulnerability to execute arbitrary commands. Usage: root@kitploit:...

cve-2025-22235-demo

CVE-2025-22235 : Démonstration de contournement d'authentification Spring Boot EndpointRequest.to Description de la vulnérabilité CVE-2025-22235 est une vulnérabilité de sécurité Spring Boot concernant la méthode EndpointRequest.to qui peut générer un matcher incorrect lors de la configuration de...

cve-2022-22947

Spring Cloud Gateway Actuator API SpEL 코드 인젝션 CVE-2022-22947 빌드 root@kitploit: $ git clone https://github.com/twseptian/cve-2022-22947.git $ cd cve-2022-22947 $ docker build . -t cve-2022-22947 $ docker run -p 9000:9000 --name cve-2022-22947 cve-2022-22947 PoC 라우터에 SpEL 표현식이 포함된 라우터를 추가하려면 다음 요청을...

spring-cloud-gateway-rce

Exécution de commande par injection d'expression SpEL dans l'API Actuator de Spring Cloud Gateway CVE-2022-22947 1.Installation root@kitploit: pip3 install -r requirements.txt 2.Utilisation root@kitploit: $ python3 spring-cloud-gateway-rce.py -h / \ /\ /\ /\ | \ / \ | \ | \ | \ | \ / \ | || | | |...

CVE-2022-22947

Spring Cloud Gateway Actuator API SpEL Code Injection CVE-2022-22947 Spring Cloud Gateway Actuator API SpEL Code Injection CVE-2022-22947 Utilisation: root@kitploit: -t http://vuldomain.com //IP unique -f urls.txt //Lire le fichier pour analyse par lots, multithread, rapide -c command //Commande...

CVE-2022-22947

CVE-2022-22947 Spring Cloud Gateway est une passerelle API de Spring. Dans ses versions 3.1.0 et 3.0.6 et antérieures incluses, il existe une vulnérabilité d'injection d'expression SpEL. Si un attaquant peut accéder à l'API Actuator, il peut exploiter cette vulnérabilité pour exécuter des command...

CVE-2022-22947-POC

Spring-Cloud-Gateway-CVE-2022-22947 Avis de sécurité relatif à la vulnérabilité d'exécution de code à distance dans Spring Cloud Gateway. Cette vulnérabilité permet à une application utilisant Spring Cloud Gateway d'être soumise à une attaque par injection de code lorsque le point de terminaison...

SpringBoot_Actuator_RCE

Interface swagger-ui /swagger-ui.html SpringBoot env : récupération d'informations sensibles masquées 1 Lorsque nous accédons directement au site SpringBoot, nous pouvons voir que certains champs password sont remplis de . 1. Grâce à $name, il est possible de récupérer les champs en clair. 2. Une...