Spring4Shell-CTF

Spring4Shell CVE-2022-22965 Vulnerability Environment Setup and CTF Challenge Design Project Overview This project includes dual-track security research implementations: 1. Traditional Vulhub Environment Setup : Leveraging the open-source Vulhub vulnerability database to quickly reproduce the...

Spring4Shell-POC

Spring4Shell CVE-2022-22965 - Remote Code Execution Proof of Concept A fully containerized Proof of Concept PoC demonstrating the exploitation of Spring4Shell CVE-2022-22965 , resulting in Remote Code Execution RCE against a vulnerable Spring Framework application deployed on Apache Tomcat. The...

Spring4Shell-CVE-2022-22965.py

Spring4Shell-CVE-2022-22965.py Script to check for Spring4Shell vulnerability Tested on https://github.com/lunasec-io/Spring4Shell-POC/blob/master/Dockerfile...

spring-rce-poc

spring-rce-poc Testing CVE-2022-22968 Simple app vulnerable to CVE-2022-22968 Dockerfile could be used to build it on vulnerable version of Tomcat 9.0.59 exploit.sh is a shell script which is trying to exploit this cve on 8080 port of localhost If attack with exploit.sh was succesfull, on context...

CVE-2024-22243

CVE-2024-22243 Author: Sean Pesce This project contains an example web application that demonstrates exploitable scenarios for CVE-2024-22243, a URL-parsing vulnerability in the Java Spring Framework official disclosure here. Vulnerability Affected versions of Spring parse the "userinfo" segment ...

Spring0DayCoreExploit

Spring Core RCE - CVE-2022-22963 Following Spring Cloud, on March 29, another heavyweight vulnerability of Spring broke out on the Internet: Spring Core RCE The Circulating coding poc: The exploit has been uploaded asexp.py The official Spring patch is also in active production Patch Links in...

POC-CVE-2024-38820

CVE-2024-38820 Prueba de Concepto Resumen Este proyecto demuestra CVE-2024-38820 , una vulnerabilidad en DataBinder de Spring Framework que permite omitir la protección disallowedFields debido a problemas de conversión de mayúsculas/minúsculas dependientes de la configuración regional. Detalles d...

CVE-2022-22965

CVE-2022-22965 Spring Framework/CVE-2022-22965 Vulnerability ID: CVE-2022-22965/CNVD-2022-23942/QVD-2022-1691 Reproduce the vulnerability docker pull vulfocus/spring-core-rce-2022-03-29 docker run -dit -p 8080:8080 vulfocus/spring-core-rce-2022-03-29 Vulnerability detection POC It is recommended ...

spring-projects__spring-framework_CVE-2022-22965_5-2-19-RELEASE

Spring Framework Build Status This is the home of the Spring Framework: the foundation for all Spring projects. Collectively the Spring Framework and the family of Spring projects are often referred to simply as "Spring". Spring provides everything required beyond the Java programming language fo...

spring4shell-CVE-2022-22965

POC simple de Spring4Shell Verificar si el endpoint es vulnerable python spring4shell.py -u http://192.168.110.117:8080/helloworld/greeting --check Explotar endpoint vulnerable python spring4shell.py -u http://192.168.110.117:8080/helloworld/greeting -f shell.jsp --exploit Ejecutar comando en...

Spring4Shell-POC

Spring4Shell-POC CVE-2022-22965 Spring4Shell CVE-2022-22965 Prueba de Concepto/Información + Un servidor Tomcat vulnerable con una aplicación Spring4Shell vulnerable. Esta mañana temprano, múltiples fuentes han informado de una posible explotación RCE en el popular framework Java Spring. El nombr...

spring-core-rce

Spring Core RCE/CVE-2022-22965 Alcance: frameworks Spring y derivados con JDK=9 Enlace al artículo El script es solo para fines de aprendizaje; cualquier otro uso y las responsabilidades legales que conlleve son ajenos al autor 1.Instalación pip3 install -r requirements.txt 2.Uso $ python3...

CVE-2022-22965

CVE-2022-22965 aka "Spring4Shell" RCE vulnerability in Spring Framework via Data Binding on JDK 9+ The goal is to centralize as much publicly known information as possible to date about the vulnerability and to know what actions to take in such a case. Is my application vulnerable? The conditions...

Spring Framework - Path Traversal

Spring Framework MVC applications deployed as WAR or with embedded Servlet containers that do not reject suspicious URI sequences and serve static resources with Spring resource handling contain a path traversal vulnerability, letting attackers access unauthorized files, exploit requires...

CVE-2018-1270

CVE-2018-1270 - Vulnerabilidad de ejecución de código SpEL en Spring messaging Ayer Spring publicó una vulnerabilidad RCE, conózcala: Ejecución remota de código con spring-messaging Versiones afectadas Spring Framework 5.0 to 5.0.4 Spring Framework 4.3 to 4.3.14 Esta vulnerabilidad no requiere...

CVE-2023-20860

Para estudiar CVE-2023-20860: Bypass de seguridad con patrón de comodín doble sin prefijo Spring Framework 6.0.7 y 5.3.26 corrigen cve-2023-20860 y cve-2023-20861...

spring-framework

Spring Framework This is the home of the Spring Framework: the foundation for all Spring projects. Collectively the Spring Framework and the family of Spring projects are often referred to simply as "Spring". Spring provides everything required beyond the Java programming language for creating...

Spring-CVE-2022-22947-

Este repositorio no tiene un README...

sprig-mvc-demo-patch

sprig-mvc-demo-patch Esta aplicación demo cubre parcialmente la vulnerabilidad CVE-2024-38828 La vulnerabilidad CVE-2024-38828 en Spring Framework permite realizar un ataque de denegación de servicio DoS enviando una solicitud grande o especialmente diseñada a un controlador Spring MVC que acepta...

SpringBreakPoC

SpringBreakPoC Necesitaba una herramienta para probar varios endpoints diferentes de la vulnerabilidad SpringBreak recién divulgada CVE-2017-8046 y no pude encontrar ninguna, así que armé esto. Uso \ \ / /| \ \ \ | \ /\ | /| || | | \ || /| | || /| || \ / / | | || | | | | \ | || | | / / | || | ||...