Spring Framework - Path Traversal

Spring Framework MVC applications deployed as WAR or with embedded Servlet containers that do not reject suspicious URI sequences and serve static resources with Spring resource handling contain a path traversal vulnerability, letting attackers access unauthorized files, exploit requires...

Spring4Shell-POC

Spring4Shell-POC CVE-2022-22965 Spring4Shell CVE-2022-22965 Proof Of Concept/Information + A vulnerable Tomcat server with a vulnerable spring4shell application. Early this morning, multiple sources has informed of a possible RCE exploit in the popular java framework spring. The naming of this fl...

CVE-2022-22965

🚨 CVE-2022-22965 — "Spring4Shell" Critical Remote Code Execution RCE vulnerability Publicly disclosed: March 31, 2022 📖 Table of Contents Overview Affected Components Technical Root Cause Exploitation Conditions Impact Severity & CVSS Mitigation & Patching Timeline Comparison with Log4Shell Summa...

CVE-2022-22965

Spring Framework Vulnerabilities - CVE-2022-22965 List of vulnerable / non-vulnerable software https://github.com/NCSC-NL/spring4shell/blob/main/software/README.md Finding vulnerable code Prerequisites for being vulnerable to CVE-2022-22965: 1 Use of Spring Framework See PowerShell and bash scrip...

POC-CVE-2024-38820

CVE-2024-38820 Proof of Concept Overview This project demonstrates CVE-2024-38820 , a vulnerability in Spring Framework's DataBinder that allows bypassing disallowedFields protection due to locale-dependent case conversion issues. Vulnerability Details CVE ID : CVE-2024-38820 Affected Component :...

Spring4Shell

Spring RCE CVE-2022-22965 Vulnerability Environment Environment Information springboot jdk11 tomcat9.0.30 payload Request Header Configuration "suffix": "%//", "c1": "Runtime", "c2": "%", "DNT": "1", "Content-Type": "application/x-www-form-urlencoded", Request Body Data...

CVE-2022-22965

👾 CVE-2022-22965 This is a proof of concept of an exploit for CVE-2022-22965 spring4shell vulnerability. It is composed by: A vulnerable Springboot application; An exploit script written in python; A safe app for test that the exploit doesn't work; A dockerfile for running the vulnerable...

CVE-2024-38821-POC

CVE-2024-38821: Proof of Concept PoC: Authentication Bypass in Spring Framework This is a proof of concept for the CVE-2024-38821 vulnerability Execution Steps 1. Build the Docker image Spring Boot 3.3.4, based on Spring Framework 6.1.13 cd vuln docker build -t cve-2024-38821-poc . 2. Run the...

SpringBreaker

SpringBreaker Exploit PoC for Spring RCE issue CVE-2011-2894...

CVE-2022-22965_Spring4Shell

CVE-2022-22965Spring4Shell CVE-2022-22965 Spring4Shell, SpringShell is a vulnerability in the Spring Framework that uses data binding functionality to bind data stored within an HTTP request to certain objects used by an application. The bug exists in the getCachedIntrospectionResults method, whi...

CVE-2024-38819-POC

CVE-2024-38819: Proof of Concept PoC This is a proof of concept for the CVE-2024-38819 vulnerability, which I reported, demonstrating a path traversal exploit. Execution Steps 1. Build the Docker image Spring Boot 3.3.4, based on Spring Framework 6.1.13 cd vuln docker build -t cve-2024-38819-poc...

SpringFramework_CVE-2022-22965_RCE

SpringFrameworkCVE-2022-22965RCE SpringFramework Remote Code Execution Vulnerability CVE-2022-22965 Vulnerability Reproduction Environment docker pull vulfocus/spring-core-rce-2022-03-29 docker run -d -p 8090:8080 --name springrce -it vulfocus/spring-core-rce-2022-03-29 Write webshell Note: The...

Spring4Shell-CVE-2022-22965

Spring4Shell: CVE-2022-22965 RCE Java Spring framework RCE vulnerability These vulnerabilities affects a component "Spring Core" — the heart of the framework Current conditions for vulnerability:- JDK 9+ A vulnerable version of the Spring Framework 5.2 | 5.2.0-19 | 5.3.0-17 Apache Tomcat as a...

log4shell-spring-framework-research

log4shell-spring-framework-research Research into the implications of CVE-2021-44228 in Spring based applications...

CVE-2024-22243

CVE-2024-22243 Author: Sean Pesce This project contains an example web application that demonstrates exploitable scenarios for CVE-2024-22243, a URL-parsing vulnerability in the Java Spring Framework official disclosure here. Vulnerability Affected versions of Spring parse the "userinfo" segment ...

CVE-2022-22965-PoC

CVE-2022-22965 PoC Minimal example of how to reproduce CVE-2022-22965 Spring RCE. Run using docker compose 1. Build the application using Docker compose docker-compose up --build 2. To test the app browse to http://localhost:8080/handling-form-submission-complete/greeting 3. Run the exploit...

irule-cve-2022-22965

irule-cve-2022-22965 This is a basic iRule to provide some mitigation against CVE-2022-22965 a.k.a. Spring4Shell. Tested on BIG-IP 15.x. Overview On March 30, 2022, a remote code execution RCE vulnerability was found in the Java Spring Framework, identified by the CVE 2022-22965. I am sharing an...

CVE-2022-22965

spring4shell ⭐ a python implementation of CVE-2022-22965 that provides a prompt to the user in the style of an ssh session. the script is designed to be easy to understand and execute, with both readability and accessbility - depending on the user's choice. Designed for exploiting the vulnerabili...

sprig-mvc-demo-patch

sprig-mvc-demo-patch This demo application partially covers the vulnerability CVE-2024-38828 The vulnerability CVE-2024-38828 in Spring Framework allows a Denial of Service DoS attack by sending a large or specially crafted request to a Spring MVC controller that accepts a parameter of type byte...

CVE-2022-22965

CVE-2022-22965 CVE-2022-22965 EXP General environment requirements: 1. Whether Spring framework is used; if not, the vulnerability does not exist 2. Whether Spring parameter binding is used; if not, the vulnerability does not exist 3. The JDK version used by the middleware; if the version is lowe...