Spring4Shell Proof Of Concept/And vulnerable application CVE-2022-22965

Spring4Shell - Spring Core RCE - CVE-2022-22965

Everything I needed to understand what was going on with "Spring4Shell" - translated source materials, exploit, links to demo apps, and more.

This is a dockerized application that is vulnerable to the Spring4Shell vulnerability (CVE-2022-22965).

Intentionally Vulnerable to Spring4Shell

《Spring漏洞研究》

CVE-2022-22965 - CVE-2010-1622 redux

This includes CVE-2022-22963, a Spring SpEL / Expression Resource Access Vulnerability, as well as CVE-2022-22965, the spring-webmvc/spring-webflux RCE termed "SpringShell".

Spring4Shell RCE exploit

Lazy SPL to detect Spring4Shell exploitation

Spring4Shell reproduce

Nmap Spring4Shell NSE script for Spring Boot RCE (CVE-2022-22965)

This enforces F5 WAF signatures for Spring4Shell and Spring Cloud vulnerabilities across all policies on a BIG-IP ASM device

Advance Spring4Shell RCE Vulnerability Scanner.

Spring4Shell Vulnerability Scanner for Windows

CVE-2022-22965 (Spring4Shell) Proof of Concept

Vulnerabilidad RCE en Spring Framework vía Data Binding on JDK 9 (CVE-2022-22965 aka "Spring4Shell")

POC to prove springshell CVE 2022-22965

A simple python script for a firewall rule that blocks incoming requests based on the Spring4Shell (CVE-2022-22965) vulnerability