9258 matches found
log4j-lookups-vulnerability
log4j-lookups-vulnerability The project based on spring-boot,and the code reveals how Log4j2 Vulnerability CVE-2021-44228 works. The solution for CVE-2021-44228 is on the linked url https://spring.io/blog/2021/12/10/log4j2-vulnerability-and-spring-boot...
CVE-2022-22947
CVE-2022-22947 Spring Cloud Gateway is an API gateway in Spring. Versions 3.1.0 and 3.0.6 inclusive and earlier have a SpEL expression injection vulnerability. If an attacker can access the Actuator API, they can exploit this vulnerability to execute arbitrary commands. Vulnerability Environment...
CVE-2022-22978
CVE-2022-22978: Spring Security Authorization Bypass Summary Spring Security framework is a security framework that provides authentication and authorization functions in Spring-based applications. In Spring Security versions 5.5.6, 5.6.3 and earlier, when using RegexRequestMatcher, a function th...
cve-2023-34040
CVE-2023-34040 Spring Kafka Deserialization Remote Code Execution POST /messages/send HTTP/1.1 Host: 127.0.0.1:8899 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10157 AppleWebKit/537.36 KHTML, like Gecko Chrome/116.0.0.0 Safari/537.36...
CVE-2022-22965
CVE-2022-22965-POC CVE-2022-22965 spring-core batch detection script Disclaimer: This script is for learning purposes only. Prohibited for illegal use. If there is any malicious destruction or illegal use, it has nothing to do with me!!! Usage: python3 CVE-2022-22965-POC.py url.txt After successf...
spring4shell-scan
spring4shell-scan A fully automated, reliable, and accurate scanner for finding Spring4Shell and Spring Cloud RCE vulnerabilities Features Support for lists of URLs. Fuzzing for more than 10 new Spring4Shell payloads previously seen tools uses only 1-2 variants. Fuzzing for HTTP GET and POST...
spring-boot-log4j-cve-2021-44228-docker-lab
Spring Boot Log4j - CVE-2021-44228 The Log4Shell vulnerability CVE-2021-44228 ultimately is a quite simple JNDI Injection flaw, but in a really really bad place. Log4J will perform a JNDI lookup while expanding placeholders in logging messages or indirectly as parameters for formatted messages...
CVE-2016-2173
CVE-2016-2173 - Remote Code Execution in Spring AMQP - App Test Description The class org.springframework.core.serializer.DefaultDeserializer does not validate the deserialized object against a whitelist. By supplying a crafted serialized object like Chris Frohoff's Commons Collection gadget,...
spring-cve-2022-22947
spring-cve-2022-22947 Spring cloud gateway code injection : CVE-2022-22947...
CVE-2021-44228-docker-example
CVE-2021-44228-docker-example A simple demonstration of CVE-2021-44228 to transfer data from a vulnerable server to a web service controlled by an attacker. All components involved are running via Docker. Components vulnerable-server This is a standard Java server acting as the victim. It's...
CVE-2022-22965
CVE-2022-22965 Spring Framework/CVE-2022-22965 Vulnerability ID: CVE-2022-22965/CNVD-2022-23942/QVD-2022-1691 Reproduce the vulnerability docker pull vulfocus/spring-core-rce-2022-03-29 docker run -dit -p 8080:8080 vulfocus/spring-core-rce-2022-03-29 Vulnerability detection POC It is recommended ...
log4shell-rmi-poc
log4shell-rmi-poc A Proof of Concept of the Log4j vulnerability CVE-2021-44228 over Java-RMI It uses Log4j 2.5.7 from spring-boot-starter-log4j2 Requirements: Tested with Java 8 JDK 1.8.025 and Java 11 JDK 11.0.1 How to run the POC 1. Clone the repo: git clone...
CVE-2019-3778-Spring-Security-OAuth-2.3-Open-Redirection
CVE-2019-3778-Spring-Security-OAuth-2.3-Open-Redirection Spring Security OAuth 2.3 Open Redirection ๅๆๅค็ฐ็ฏ Exploit Title: Open Redirector in spring-security-oauth2 Date: 17 June 2019 Exploit Author: Riemann Vendor Homepage: https://spring.io/projects/spring-security-oauth Software Link:...
log4j-spring-vuln-poc
log4j Spring vulnerable POC This is a POC for a simple spring boot start backend with maven including vulnerable log4j version for CVE-2021-44228 Spring boot bootstrapped with https://start.spring.io. commands ./mvnw spring-boot:run: start server ./mvnw dependency:tree: print dependency tree and...
log4shell-spring-framework-research
log4shell-spring-framework-research Research into the implications of CVE-2021-44228 in Spring based applications...
CVE-2023-34040
CVE-2023-34040 This PoC is cloned from https://github.com/Contrast-Security-OSS/Spring-Kafka-POC-CVE-2023-34040 About our analyzing process, please visit PDF file on the main repo...
CVE-2022-22965
Spring Boot CVE-2022-22965 Docker PoC for CVE-2022-22965 with Spring Boot version 2.6.5 ๐ Getting Started 1. Download the distribution code from https://github.com/itsecurityco/CVE-2022-22965/archive/refs/heads/master.zip and unzip it. 2. Run docker compose up --build to build and start the...
CVE-2018-1273
CVE-2018-1273 Environment for CVE-2018-1273 CVE-2018-1273: RCE with Spring Data Commons https://pivotal.io/security/cve-2018-1273 Application https://github.com/spring-projects/spring-data-examples/tree/master/web/example Build $ docker build -t cve-2018-1273 . Run $ docker run -d -p 8080:8080...
CVE-2022-22978
CVE 2022-22978: Authorization Bypass in RegexRequestMatcher ๐ฅถ Overview According to the information I gathered, this is a vulnerability related to the RegexRequestMatcher class in the Spring Security framework. Specifically, applications using RegexRequestMatcher where the regular expression...
cve-2022-22947
cve-2022-22947 Spring Cloud Gateway is an API gateway in Spring. Versions 3.1.0 and 3.0.6 inclusive and earlier contain a SpEL expression injection vulnerability. When an attacker can access the Actuator API, they can exploit this vulnerability to execute arbitrary commands. Usage: โ...