tpt11fb/SpringVulScan

PoC

burpsuite 的Spring漏洞扫描插件。SpringVulScan：支持检测：路由泄露|CVE-2022-22965|CVE-2022-22963|CVE-2022-22947|CVE-2016-4977

view exploit source poc_in_githubauthor tpt11fbpublished 2022-06-19catalog poc_in_github

exploited CVEs (2)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2022-22965US	critical9.8OT critical	99.6% (100th)	KEV	2022-04-01
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run…
CVE-2016-4977US	high8.8	79.2% (100th)	Exploit	2017-05-25
When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_type parameter value was executed as Spri…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.