SpringBreaker

SpringBreaker Exploit PoC for Spring RCE issue CVE-2011-2894...

Spring4Shell-CVE-2022-22965

Spring4Shell-CVE-2022-22965 EXP for Spring4ShellCVE-2022-22965...

CVE-2022-22965

Spring4ShellCVE-2022-22965 Spring Framework RCE via Data Binding on JDK 9+ / spring4shell / CVE-2022-22965 Spring4ShellCVE-2022-22965 Exploit Demo https://user-images.githubusercontent.com/57348147/161458377-44ab2f76-f947-4599-aa0a-92cbaac819f8.mp4 Build docker pull me2nuk/cves:2022-22965 docker...

CVE-2020-27223

CVE-2020-27223 Using $ mvn spring-boot:run 9.4.36.v20210114 $ ./poc/cve-2020-27223-poc1.sh "timens":"58,557","acceptlanguage":"aab" real 0m0.093s 🐇 user 0m0.006s sys 0m0.007s "timens":"18,461,763,438","acceptlanguage":"ahn" real 0m35.339s 🐢 user 0m0.006s sys 0m0.006s 9.4.37.v20210219 Fixed $...

CVE-2022-22965_Spring4Shell

CVE-2022-22965Spring4Shell CVE-2022-22965 Spring4Shell, SpringShell is a vulnerability in the Spring Framework that uses data binding functionality to bind data stored within an HTTP request to certain objects used by an application. The bug exists in the getCachedIntrospectionResults method, whi...

spring-core-rce

Spring Core RCE/CVE-2022-22965 Affected scope: Spring framework and derivative frameworks with JDK=9 Reference article This script is for learning purposes only. Any legal liability arising from its use for other purposes is solely the responsibility of the user, not the author. 1. Installation...

Log4Shell-PoC-Application

☕ Log4Shell PoC Application Spring framework based web application for proof of concept for log4shell vulnerabilities Install & Launch !Important JDK 1.88u131 in development is required to launch this project Use the provided Dockerfile to build and run the Docker image for poc application. docke...

spring-framework

Spring Framework This is the home of the Spring Framework: the foundation for all Spring projects. Collectively the Spring Framework and the family of Spring projects are often referred to simply as "Spring". Spring provides everything required beyond the Java programming language for creating...

spring4shell-local-verification-lab

Spring4Shell Local Impact Condition Verification, Remediation, and Re-testing Project Project Introduction This project is used for learning and verifying the impact conditions, risk manifestations, remediation methods, and post-remediation re-testing procedures for Spring Framework CVE-2022-2296...

CVE-2024-38828

CVE-2024-38828 Vulnerability Description The test checks behavior/reaction in Spring Framework with and without the CVE-2024-38828 vulnerability. In ByteArrayHttpMessageConverter, memory is allocated in ByteArrayOutputStream based on the Content-Length request header, which may not match reality ...

CVE-2022-22965

👾 CVE-2022-22965 This is a proof of concept of an exploit for CVE-2022-22965 spring4shell vulnerability. It is composed by: A vulnerable Springboot application; An exploit script written in python; A safe app for test that the exploit doesn't work; A dockerfile for running the vulnerable...

CVE-2024-38819-POC

CVE-2024-38819: Proof of Concept PoC This is a proof of concept for the CVE-2024-38819 vulnerability, which I reported, demonstrating a path traversal exploit. Execution Steps 1. Build the Docker image Spring Boot 3.3.4, based on Spring Framework 6.1.13 cd vuln docker build -t cve-2024-38819-poc...

CVE-2022-22965-PoC

CVE-2022-22965 PoC Minimal example of how to reproduce CVE-2022-22965 Spring RCE. Run using docker compose 1. Build the application using Docker compose docker-compose up --build 2. To test the app browse to http://localhost:8080/handling-form-submission-complete/greeting 3. Run the exploit...

CVE-2022-22965

Spring Framework Remote Code Execution Vulnerability CVE-2022-22965 Analysis Code Analysis on BiliBili:https://www.bilibili.com/video/BV1jY4y1H7EC...

Spring4ShellPoC

Spring4ShellPoC Spring4Shell PoC CVE-2022-22965 Just playing with the exploit. Modified from the good work done by BobTheShopLifter, https://github.com/BobTheShoplifter/Spring4Shell-POC and TryHackMe, https://tryhackme.com/room/spring4shell Just a few tweaks. Added a some extra bits when checking...

CVE-2022-22965-Spring4Shell

Spring4Shell Spring4Shell CVE-2022-22965 Proof Of Concept with a vulnerable Tomcat server with a vulnerable spring4shell application. Details about this vulnerability https://websecured.io/blog/624411cf775ad17d72274d16/spring4shell-poc...

cve-2022-42889-text4shell

Install maven - maven-linux 1. Maven install to create the fat jar mvn clean install 2. Docker build docker build --tag=text4shell . 3. Docker run docker run -p 80:8080 text4shell 4. Test the app http://localhost/text4shell/attack?search= 5. Attack can be performed by passing a string...

Spring4Shell-POC

Spring4Shell-POC CVE-2022-22965 Spring4Shell CVE-2022-22965 Proof Of Concept/Information + A vulnerable Tomcat server with a vulnerable spring4shell application. Early this morning, multiple sources has informed of a possible RCE exploit in the popular java framework spring. The naming of this fl...

Spring4shell-CVE-2022-22965-POC

Spring4shell RCE vulnerability This vulnerability affects Spring Core and allows an attacker to send a specially crafted HTTP request to bypass protections in the library’s HTTP request parser, leading to remote code execution. More info Here In order for this vulnerability to be exploited, sever...

Spring Framework - Path Traversal

Spring Framework MVC applications deployed as WAR or with embedded Servlet containers that do not reject suspicious URI sequences and serve static resources with Spring resource handling contain a path traversal vulnerability, letting attackers access unauthorized files, exploit requires...