53 matches found
hopgoblin
hopgoblin hopgoblin is a scanner for Adobe Experience Manager AEM instances. It automates a handful of checks that we frequently perform manually during security assessments. Features Detects exposed QueryBuilder endpoints: /bin/querybuilder.json /bin/querybuilder.feed Abuses QueryBuilder to:...
CVE-2020-10199
Nexus Repository Manager 3 Vuln Affected versions: = 3.21.2 CVE-2020-10199, CVE-2020-10204, CVE-2020-11444 CVE-2020-10199 Remote Code Execution Echo PoC No Echo PoC $\A''.getClass.forName'java.lang.Runtime'.getMethods6.invokenull.exec'touch /tmp/cve-2020-10199' Normal User Privileges...
CVE-2026-2587-Exploit-POC
CVE-2026-2587 Exploit PoC ā Eclipse GlassFish EL Injection RCE Validator Safe PoC validator for CVE-2026-2587, a critical EL Injection / RCE issue affecting Eclipse GlassFish admin console gadget handling via /common/gadgets/gadget.jsf. This tool helps security teams validate GlassFish...
Sonatype Nexus Repository Manager 3 - Remote Code Execution
Sonatype Nexus Repository Manager 3 up to and including 3.21.1 is vulnerable to Expression Language injection. An attacker authenticated with an administrative account can inject an EL expression into the user "roles" field of the coreuiUser update endpoint, leading to remote code execution. This...
cve-2018-14667
cve-2018-14667 POC for CVE-2018-14667 Original analysis and POC: https://paper.seebug.org/765/ Ref: https://web.archive.org/web/20190501081357/https://tint0.com/when-el-injection-meets-java-deserialization/...
Nexus-Repository-Manager3-EL-CVE-2018-16621-https-www.cve.org-CVERecord-id-CVE-2018-16621-
This script targets the Nexus Repository Manager 3 EL injection vulnerability CVE-2018-16621, and performs one-click exploitation to get a reverse shell. Running Example: Run the script on the attacker machine, enter the target IP, port, local listener IP and port as prompted, then execute the...
CVE-2018-12533
RF-14310 / CVE-2018-12533 payload generator Based on Lucifaer research All credit goes to https://github.com/Lucifaer References https://access.redhat.com/security/cve/cve-2018-12533 richfaces-jboss-poc Easy to deploy proof of concept to practice Richfaces 3.3.4 deserialization + EL injection...
CVE-2017-1000486
CVE-2017-1000486 Remote Code Execution exploit for PrimeFaces 5.x - EL Injection CVE-2017-1000486 This is basically the same exploit made by Mogwailabs, but edited to work in closed environments without access to the internet or with blocked firewall outbound traffic. It gives you results in HTTP...
pwnfaces
š pwnfaces Primefaces 5.X EL Injection Exploit šµļø What is pwnfaces? šµļø pwnfaces is a Golang tool created to exploit the vulnerability defined as CVE-2017-1000486 EL Injection in PrimeFaces 5.X ā” Installing / Getting started A quick guide of how to install and use pwnfaces. 1. go install...
CVE-2017-1000486
CVE-2017-1000486 This is a PoC of CVE-2017-1000486 with some payloads useful to bypass blacklisting lexicographic checks on standard functions used to achieve RCE getClass, exec, etc.. and for retrieving primefaces secret through Padding Oracle in order to be less noisy possible on exploitation...
CVE-2017-1000486
CVE-2017-1000486 Proof of Concept Exploit for PrimeFaces 5.x EL Injection CVE-2017-1000486, a RCE vulnerability that can be used to gain Remote Code Execution on a target. Vulnerability description You can find an excellent description of the vulnerability on the Minded Security blog. Usage The...
wildfly-clustering-faces-mojarra: com.sun.faces:jsf-impl: org.glassfish:jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include
A flaw was found in EAP. Any estate hosting a JSF app using the user-controlled-include pattern would permit EL injection, achieving unauthenticated RCE as the server process user...
wildfly-clustering-faces-mojarra: com.sun.faces:jsf-impl: org.glassfish:jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include
A flaw was found in EAP. Any estate hosting a JSF app using the user-controlled-include pattern would permit EL injection, achieving unauthenticated RCE as the server process user...
wildfly-clustering-faces-mojarra: com.sun.faces:jsf-impl: org.glassfish:jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include
A flaw was found in EAP. Any estate hosting a JSF app using the user-controlled-include pattern would permit EL injection, achieving unauthenticated RCE as the server process user...
Expression Language Injection
Spring Web Flow is vulnerable to Expression Language Injection. The vulnerability is due to malicious Unified EL expressions being processed by WebFlowELExpressionParser, allowing an attacker to execute arbitrary expressions in affected applications...
wildfly-clustering-faces-mojarra: com.sun.faces:jsf-impl: org.glassfish:jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include
A flaw was found in EAP. Any estate hosting a JSF app using the user-controlled-include pattern would permit EL injection, achieving unauthenticated RCE as the server process user...
wildfly-clustering-faces-mojarra: com.sun.faces:jsf-impl: org.glassfish:jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include
A flaw was found in EAP. Any estate hosting a JSF app using the user-controlled-include pattern would permit EL injection, achieving unauthenticated RCE as the server process user...
wildfly-clustering-faces-mojarra: com.sun.faces:jsf-impl: org.glassfish:jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include
A flaw was found in EAP. Any estate hosting a JSF app using the user-controlled-include pattern would permit EL injection, achieving unauthenticated RCE as the server process user...
wildfly-clustering-faces-mojarra: com.sun.faces:jsf-impl: org.glassfish:jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include
A flaw was found in EAP. Any estate hosting a JSF app using the user-controlled-include pattern would permit EL injection, achieving unauthenticated RCE as the server process user...
