3125 matches found
log4shell-vulnerable-app
Log4Shell sample vulnerable application CVE-2021-44228 This repository contains a Spring Boot web application vulnerable to CVE-2021-44228, nicknamed Log4Shell. It uses Log4j 2.14.1 through spring-boot-starter-log4j2 2.6.1 and the JDK 1.8.0181. Running the application Run it: docker run --name...
CVE-2022-22963
CVE-2022-22963 CVE-2022-22963 Spring-Cloud-Function-SpELRCE Vulnerability Reproduction Requires Docker environment Method 1 to start the vulnerable environment git clone https://github.com/RanDengShiFu/CVE-2022-22963.git;cd CVE-2022-22963;bash Start.sh Method 2 to start the vulnerable environment...
CVE-2026-16723
CVE-2026-16723 Fastjson RCE ★ CVE-2026-16723 Fastjson @JSONType RCE PoC ★ Overview CVE-2026-16723 is a Remote Code Execution RCE vulnerability in Fastjson 1.x 1.2.68 – 1.2.83. When Fastjson parses attacker-controlled JSON, a crafted @type value is turned into a class-resource lookup inside...
CVE-2022-22965
Spring Boot CVE-2022-22965 Docker PoC for CVE-2022-22965 with Spring Boot version 2.6.5 🚀 Getting Started 1. Download the distribution code from https://github.com/itsecurityco/CVE-2022-22965/archive/refs/heads/master.zip and unzip it. 2. Run docker compose up --build to build and start the...
cve-2016-1000027-poc
PoC for CVE-2016-1000027 This is a demo Spring Boolt application that is affected by CVE-2016-1000027. Steps to reproduce the vulnerability 1. Start a vulnerable server com.gypsyengineer.server.Server. 2. Run com.gypsyengineer.client.Exploit. The Exploit class reads payload.bin and sends it to th...
log4j-polkit-poc
log4j CVE-2021-44228 + polkit CVE-2021-4034 Vulnerable instance for the log4j apache exploit and privilege escalation using polkit The vulnable spring-boot-application.jar was extracted from this docker image The malicious JNDI server was downloaded from here and referenced in this article. PoC...
log4shellwithlog4j2_13_3
log4shellwithlog4j2133 Springboot web application accepts a name get parameter and logs its value to log4j2. Vulnerable to CVE-2021-44228. build the Springboot vulnerable application with mvn clean install run the Springboot application with the k2 agent with java --add-modules java.sql...
Log4Shell
Log4Shell This repository is for Log4j 2021 CVE-2021-44228 Vulnerability demonstration and mitigation. What is Log4Shell? The CVE-2021-44228 / Log4Shell vulnerability consists of injecting vulnerable software with a malicious payload, which will ask Log4J to obtain a value from a third-party...
Demo-Exploit-Jackson-RCE
Demo-Exploit-Jackson-RCE Based on the project jackson-rce-via-spel this project serves as an example web application to test multiple attack vectors file upload, forms on the Jackson-databind vulnerability. Introduction Based on an Angular7 frontend and a spring-boot backend different attack...
CVE-2022-22965-rexbb
CVE-2022-22965-rexbb SpringBoot Core command execution vulnerability. CVE-2022-22965 exploitation tool, developed based on JavaFx, making graphical operation simpler and improving efficiency. December 28, 2022 - Wednesday - 21:44 I have been doing vulnerability reproduction these days and suddenl...
boot-jackson-cve
Reproduction of CVE-2020-36518 in Spring Boot 2.5.10 Execute: ./mvnw clean verify It will fail with: ERROR Failed to execute goal org.owasp:dependency-check-maven:7.0.0:check default on project jackson-demo: ERROR ERROR One or more dependencies were identified with vulnerabilities that have a CVS...
CVE-2023-1454-Jeecg-Boot-qurestSql-SQLvuln
CVE-2023-1454 Jeecg-Boot-qurestSql-SQLvuln jmreport/qurestSql Unauthorized SQL Injection Batch Scan PoC. Jeecg-Boot is a rapid development platform based on Spring Boot and Jeecg-Boot-Plus. The latest version jeecg-boot 3.5.0 has been exposed with multiple SQL injection vulnerabilities. Usage...
CVE-2021-45105
tejas-nagchandi/CVE-2021-45105 Replicating CVE-2021-45105 API curl -I localhost:8080/currentDateTime -H 'Time-Zone: GMT' Output: Attack curl -I localhost:8080/currentDateTime -H 'Time-Zone: $$::-$::-$$::-$' Output: Logs: Reference: https://vulners.com/cve/CVE-2021-45105...
cve-2022-31692
CVE-2022-31692 Demo Overview A simple Spring Boot application demonstrating configuration that is vulnerable to CVE-2022-31692. This vulnerability may attract attention due to its severity - it has a CVSS 3.x base score of 9.8 as it allows authentication bypass. The purpose of this project is to...
log4j2-CVE-2021-45105
Sample Log4j2 vulnerable application CVE-2021-45105 Versions Affected: all versions from 2.0-beta9 to 2.16.0 This application is based on Spring Boot web application vulnerable to CVE-2021-45105 It uses Log4j 2.16.0 Running the application Run it: Import the project in Java IDE as a maven project...
log4j-vulnerability
Log4Shell CVE-2021-44228 is a zero-day vulnerability in Log4j Log4J Vulnerability Discovered: 24th November 2021 Patched: 6th December 2021 Attack Demo Click below for youtube video Sample application This sample application is spring boot application, and is using log4j as a logging framework, a...
CVE-2022-22980
CVE-2022-22980 A local based poc of CVE-2022-22980, for the detail of this vulnerability see https://tanzu.vmware.com/security/cve-2022-22980. You need to install mongodb on locahost before running. And I've create a web based poc with docker on dockerv Run mvn spring-boot:run or open with IDEA,...
spring-boot-log4j-cve-2021-44228-docker-lab
Spring Boot Log4j - CVE-2021-44228 The Log4Shell vulnerability CVE-2021-44228 ultimately is a quite simple JNDI Injection flaw, but in a really really bad place. Log4J will perform a JNDI lookup while expanding placeholders in logging messages or indirectly as parameters for formatted messages...
CVE-2022-22970
Spring CVE-2022-22970 Proof of Concept This repo contains a Development Container environment and Spring application of the correct version specifically to explore this CVE. Setup Instructions Clone the repo to your machine and use Docker and your favorite IDE. OR Use GitPod online with...