spring-data-rest-CVE-2017-8046

image:https://spring.io/badges/spring-data-rest/ga.svgSpring Data REST, link="http://projects.spring.io/spring-data-rest/quick-start" image:https://spring.io/badges/spring-data-rest/snapshot.svgSpring Data REST, link="http://projects.spring.io/spring-data-rest/quick-start" = Spring Data REST The...

CVE-2017-8046

DISCLAIMER: This repository is supplementary to the VGS blog post, How to Avoid "Using Components with Known Vulnerabilities". It contains an application with a known security vulnerability namely, CVE-2017-8046, as well as the description of how to exploit it. Use the application at your own ris...

VulnerableSpringDataRest

Vulnerable Spring DataRest App This is an intentionally Spring Data REST Application to test and demostrate the CVE-2017-8046 vulnerability and the challenges of testing Command Injection and Remote Code Execution via REST apis It has support for Swagger UI to use with tools where Swagger...

CVE-2017-8046

This repository does not have a README...

SpringBreakVulnerableApp

Spring Break Vulnerable Application This is a vulnerable application to test the exploit for the Spring Break vulnerability CVE-2017-8046. WARNING! This application contains serious security vulnerabilities. Run it at your own risk! It is recommended using a backed-up and sheltered environment su...

spring-break_cve-2017-8046

spring-breakcve-2017-8046 This is a Java program that exploits Spring Break vulnerability CVE-2017-8046. This software is written to have as less external dependencies as possible. DISCLAIMER This tool is intended for security engineers and appsec guys for security assessments. Please use this to...

CVE-2017-8046-DEMO

spring data rest CVE-2017-8046 demo test please UPGRADE spring data rest NOW. steps 启动本应用 创建test instance POST /entityPersons/ HTTP/1.1 Host: localhost:8080 Content-Type: application/json Cache-Control: no-cache "firstName":"f2" 利用spel注入, 会启动C:\Windows\system32\calc.exe PATCH /entityPersons/1...

SpringBreakPoC

SpringBreakPoC I needed a tool to test several different endpoints for the recently disclosed SpringBreak vulnerability CVE-2017-8046 and couldn't find one, so I threw this together. Usage \ \ / /| \ \ \ | \ /\ | /| || | | \ || /| | || /| || \ / / | | || | | | | \ | || | | / / | || | || / / | |...

spring-break_cve-2017-8046

spring-breakcve-2017-8046 Este es un programa Java que explota la vulnerabilidad Spring Break CVE-2017-8046. Este software está escrito para tener la menor cantidad de dependencias externas posible. AVISO LEGAL Esta herramienta está destinada a ingenieros de seguridad y profesionales de appsec pa...

org.springframework.data:spring-data-rest-hal-browser (3.0.0.release), org.springframework.data:spring-data-rest-webmvc (3.0.0.release) potentially affected by CVE-2017-8046 via org.springframework.data:spring-data-rest-core (3.0.0.release)

org.springframework.data:spring-data-rest-core MAVEN version 3.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-hal-browser...

org.springframework.data:spring-data-rest-hal-browser (3.0.0.release), org.springframework.data:spring-data-rest-webmvc (3.0.0.release) potentially affected by CVE-2017-8046 via org.springframework.data:spring-data-rest-core (3.0.0.release)

org.springframework.data:spring-data-rest-core MAVEN version 3.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - org.springframework.data:spring-data-rest-hal-browser...

am.ik.home:uaa-server (>=1.0.0, <=1.9.0), br.com.intelipost:sdk-java (>=0.0.1, <=0.0.8) +69 more potentially affected by CVE-2017-8046 via org.springframework.data:spring-data-rest-core (>=2.0.0.release, <=2.6.8.release)

org.springframework.data:spring-data-rest-core MAVEN version =2.0.0.release, =1.0.0, =0.0.1, =2.3.0-release, =0.0.6, =0.0.1, =0.0.1, =1.0.0, =79, =92 - com.heapbrain:heapaudit 1.0.0 and more Source cves: CVE-2017-8046 Source advisory: OSV:GHSA-9QF9-28H9-HQCJ...

am.ik.home:uaa-server (>=1.0.0, <=1.9.0), br.com.intelipost:sdk-java (>=0.0.1, <=0.0.8) +69 more potentially affected by CVE-2017-8046 via org.springframework.data:spring-data-rest-core (>=2.0.0.release, <=2.6.8.release)

org.springframework.data:spring-data-rest-core MAVEN version =2.0.0.release, =1.0.0, =0.0.1, =2.3.0-release, =0.0.6, =0.0.1, =0.0.1, =1.0.0, =79, =92 - com.heapbrain:heapaudit 1.0.0 and more Source cves: CVE-2017-8046 Source advisory: GHSA-9QF9-28H9-HQCJ...

hutstore.vn Cross Site Scripting vulnerability OBB-1237457

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Critical: Red Hat Security Advisory: Red Hat FIS 2.0 on Fuse 6.3.0 R7 security and bug fix update

An update is now available for Red Hat Fuse Integration Services. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution Ex

Exploit for java platform in category web applications // Exploit Title: RCE in PATCH requests in Spring Data REST // Date: 2018-03-10 // Exploit Author: Antonio Francesco Sardella // Vendor Homepage: https://pivotal.io/ // Software Link: https://projects.spring.io/spring-data-rest/ // Version:...

Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution

// Exploit Title: RCE in PATCH requests in Spring Data REST // Date: 2018-03-10 // Exploit Author: Antonio Francesco Sardella // Vendor Homepage: https://pivotal.io/ // Software Link: https://projects.spring.io/spring-data-rest/ // Version: Spring Data REST versions prior to 2.6.9 Ingalls SR9,...

Spring Data REST 2.6.9 (Ingalls SR9) 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution

Spring Data REST 2.6.9 Ingalls SR9 3.0.1 Kay SR1 - PATCH Request Remote Code Execution // Exploit Title: RCE in PATCH requests in Spring Data REST // Date: 2018-03-10 // Exploit Author: Antonio Francesco Sardella // Vendor Homepage: https://pivotal.io/ // Software Link:...

Exploit for Improper Input Validation in Vmware Spring_Boot

Spring Break Vulnerable Application This is a vulnerable appl...

CVE-2017-8046

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 Ingalls SR9, versions prior to 3.0.1 Kay SR1 and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code...