spring4shell-exploit-poc

Spring4Shell 익스플로잇 PoC Spring4Shell 취약점에 노출된 Spring 애플리케이션을 익스플로잇합니다. Spring4Shell에 대한 자세한 내용은 블로그에서 확인하세요. 사용법 요구 사항: Docker 및 docker-compose root@kitploit: $ ./exploit.sh 취약한 Spring 애플리케이션 취약한 Spring 애플리케이션에는 /helloworld/greeting에 대한 GET 및 POST 요청 핸들러가 포함되어 있습니다. exploit.sh 스크립트는 애플리케이션을 WAR로...

Spring4Shell-PoC-exploit

Spring4Shell - PoC CVE - 2022 - 22965 영향을 받는 버전 : Spring Framework 버전 5.3.0 5.3.17, 5.2.0 5.2.19 및 이전 버전 Java JDK 9 Apache Tomcat 버전 10..0.20 미만, 9.0.62 미만, 8.5.78 미만 전통적인 WAR로 패키징되어 spring-webmvc 또는 spring-webflux 종속성을 사용하고 독립형 Servlet 컨테이너에 배포된 애플리케이션이 영향을 받습니다. 설명 이 문제는 classLoader 조작을 통해 악용될 ...

tomcatWarDeployer

tomcatWarDeployer Apache Tomcat 자동 WAR 배포 및 침투 테스트 도구. 무엇인가요? 이 도구는 Apache Tomcat 자격 증명을 활용하여 JSP 백도어를 자동으로 생성 및 배포하고, 이후 이를 호출하여 편리한 셸웹 GUI, 원격 머신에 바인딩된 리스닝 포트, 또는 공격자에게 연결되는 리버스 TCP 페이로드을 제공하는 침투 테스트 도구입니다. 실제로, 침투 테스터가 제공한 유효한 HTTP 인증 자격 증명또는 사용자 지정 자격 증명, 결국 우리 모두 tomcat:tomcat 을 좋아합니다을 사용하여...

CVE-2022-22965

CVE-2022-22965 Spring4Shell-PoC 버전 Spring Framework 5.2.20 미만 및 5.3.18 미만 패치 버전: Spring Framework 5.3.18 및 5.2.20 Spring Boot 2.6.6 및 2.5.12 상세 정보 Spring Core는 Spring Framework의 핵심 구성 요소입니다. Spring MVC, Spring Boot, Spring WebFlux와 같은 Spring Framework 생태계의 다른 구성 요소를 구축하기 위한 기반입니다. 익스플로잇 코드는 다음 조건...

St2-052

S2-052의 POC 테스트원래 이름: Tomcat war 배포 원문 주소: http://blog.csdn.net/caiqiiqi/article/details/77861477 struts2 공식 웹사이트에서 마지막으로 영향을 받는 버전인 struts-2.5.12를 다운로드하세요. 주소: http://archive.apache.org/dist/struts/2.5.12/struts-2.5.12-apps.zip struts-2.5.12-apps만 다운로드하면 됩니다. struts-2.5.12-all.zip은 다운로드할 필요가 없습니...

Spring4Shell-CVE-2022-22965

Spring4Shell: CVE-2022-22965 RCE Java Spring 프레임워크 RCE 취약점 이 취약점들은 프레임워크의 핵심인 "Spring Core" 구성 요소에 영향을 미칩니다. 현재 취약점 조건:- JDK 9+ Spring Framework의 취약한 버전 5.2 | 5.2.0-19 | 5.3.0-17 WAR로 패키징된 Spring 애플리케이션의 서버로 Apache Tomcat 사용 Spring Framework의 spring-webmvc 및/또는 spring-webflux 구성 요소에 대한 의존성 익스플로잇...

CVE-2026-12986

Technical details are not publicly available in the provided documents. Monitor for updates.

Security Bulletin: Path traversal vulnerability affect IBM Business Automation Workflow - CVE-2025-41242

Summary IBM Business Automation Workflow packages a vulnerable version of spring. Vulnerability Details CVEID:CVE-2025-41242 DESCRIPTION: Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can ...

EUVD-2025-25122

Malicious code in bioql PyPI...

Spring Framework MVC Applications Path Traversal Vulnerability

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: the application is deployed as a WAR or with an embedded Servlet container the Servlet...

CVE-2025-41242 CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: the application is deployed as a WAR or with an embedded Servlet container the Servlet...

CVE-2025-41242

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: the application is deployed as a WAR or with an embedded Servlet container the Servlet...

CVE-2025-41242 CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: the application is deployed as a WAR or with an embedded Servlet container the Servlet...

Relative Path Traversal

Overview org.springframework:spring-beans is a package that is the basis for Spring Framework's IoC container. The BeanFactory interface provides an advanced configuration mechanism capable of managing any type of object. Affected versions of this package are vulnerable to Relative Path Traversal...

Exploit for Unrestricted Upload of File with Dangerous Type in Apache Tomcat

TomcatScanPro README Version: EnglishREADMEEN.m...

CVE-2023-33247

Talend Data Catalog remote harvesting server before 8.0-20230413 contains a /upgrade endpoint that allows an unauthenticated WAR file to be deployed on the server. A mitigation is that the remote harvesting server should be behind a firewall that only allows access to the Talend Data Catalog serv...

SUSE CVE-2022-22965

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is...

Security Bulletin: IBM Case Manager is affected but not classified as vulnerable to a remote code execution in Spring Framework [CVE-2022-22965]

Summary IBM Case Manager is affected but not classified as vulnerable to a remote code execution in Spring Framework CVE-2022-22965. To be vulnerable a product must meet all of the following criterias: 1. JDK 9 or higher, 2. Apache Tomcat as the Servlet container, 3. Packaged as WAR in contrast t...

Security Bulletin: IBM Spectrum Symphony is affected but not classified as vulnerable by a remote code execution in Spring Framework (CVE-2022-22965)

Summary IBM Spectrum Symphony is affected but not classified as vulnerable to a remote code execution in Spring Framework CVE-2022-22965 as it does not meet all of the following criteria: 1. JDK 9 or higher, 2. Apache Tomcat as the Servlet container, 3. Packaged as WAR in contrast to a Spring Boo...

Security Bulletin: Rational Test Control Panel component in Rational Test Virtualization Server and Rational Test Workbench is affected but not classified as vulnerable by a remote code execution in Spring Framework (CVE-2022-22965)

Summary Rational Test Control Panel is affected but not vulnerable to a remote code execution in Spring Framework CVE-2022-22965 as it does not meet all of the following criteria: 1. JDK 9 or higher, 2. Apache Tomcat as the Servlet container, 3. Packaged as WAR in contrast to a Spring Boot...