CVE-2023-20860 PoC — Spring Framework 安全漏洞

Source

https://github.com/limo520/CVE-2023-20860

Associated Vulnerability

Title:Spring Framework 安全漏洞 (CVE-2023-20860)
Description:Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.

Readme

# For studying

[CVE-2023-20860: Security Bypass With Un-Prefixed Double Wildcard Pattern](https://spring.io/security/cve-2023-20860)

[Spring Framework 6.0.7 and 5.3.26 fix cve-2023-20860 and cve-2023-20861](https://spring.io/blog/2023/03/20/spring-framework-6-0-7-and-5-3-26-fix-cve-2023-20860-and-cve-2023-20861?utm_source=dlvr.it&utm_medium=twitter)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →