SpringBreaker

SpringBreaker Exploit PoC for Spring RCE issue CVE-2011-2894...

com.evasion:api (>=1.0.0.1, <=1.0.0.3), com.evasion:application-ear (>=1.0.0.1, <=1.0.0.3) +104 more potentially affected by CVE-2011-2894 via org.springframework.security:spring-security-core (>=2.0.0, <=2.0.6.release)

org.springframework.security:spring-security-core MAVEN version =2.0.0, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =1.0.0.1, =2.4.7, =2.4.8 and more Source cves: CVE-2011-2894 Source advisory:...

br.net.woodstock.rockframework:rockframework-domain (>=1.2.1, <=1.2.2), com.force.sdk:force-springsecurity (>=22.0.2-beta, <=22.0.9-beta) +219 more potentially affected by CVE-2011-2894 via org.springframework.security:spring-security-core (>=3.0.0.release, <=3.0.5.release)

org.springframework.security:spring-security-core MAVEN version =3.0.0.release, =1.2.1, =22.0.2-beta, =1.0.0-beta-1, =3.0.2, =1.2.0, =1.1, =0.1, =1.2-1, =2011.11.07.release, =2011.11.07.release, =2011.11.07.release, =3.49, =3.55 and more Source cves: CVE-2011-2894 Source advisory:...

at.molindo:molindo-notify (>=1.0.0-alpha-1, <=1.0.0-alpha-2), be.eliwan:ew-profiling-api (>=1.0, <=1.4) +1704 more potentially affected by CVE-2011-2894 via org.springframework:spring-core (>=3.0.0.release, <=3.0.5.release)

org.springframework:spring-core MAVEN version =3.0.0.release, =1.0.0-alpha-1, =1.0, =1.0, =0.7, =2.0-beta1, =1.1.1, =1.0.2, =1.1.2, =1.2, =1.0.0, =1.0.0, =1.1.0, =3.3.0, =3.4.1 and more Source cves: CVE-2011-2894 Source advisory: OSV:GHSA-F866-M9MV-2XR3...

at.molindo:molindo-notify (>=1.0.0-alpha-1, <=1.0.0-alpha-2), be.eliwan:ew-profiling-api (>=1.0, <=1.4) +1704 more potentially affected by CVE-2011-2894 via org.springframework:spring-core (>=3.0.0.release, <=3.0.5.release)

org.springframework:spring-core MAVEN version =3.0.0.release, =1.0.0-alpha-1, =1.0, =1.0, =0.7, =2.0-beta1, =1.1.1, =1.0.2, =1.1.2, =1.2, =1.0.0, =1.0.0, =1.1.0, =3.3.0, =3.4.1 and more Source cves: CVE-2011-2894 Source advisory: GHSA-F866-M9MV-2XR3...

CVE-2011-2894

Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by 1 serializing a...