CVE-2018-1270 PoC — Pivotal Software Spring Framework 代码注入漏洞

Source

https://github.com/CaledoniaProject/CVE-2018-1270

Associated Vulnerability

Title:Pivotal Software Spring Framework 代码注入漏洞 (CVE-2018-1270)
Description:Vmware Spring Framework是美国威睿（Vmware）公司的一套开源的Java、JavaEE应用程序框架。该框架可帮助开发人员构建高质量的应用。 Spring Framework 5.0.5之前的5.0版本、4.3.15之前的4.3版本和不再支持的老版本中存在代码注入漏洞。该漏洞是源于网络系统或产品中缺少身份验证、访问控制、权限管理等安全措施。

Description

Spring messaging STOMP protocol RCE

File Snapshot


 [4.0K]  /data/pocs/298741172633dd830bc8c8133a77e069bfbc9e63
├── [4.0K]  contrib
│   ├── [508K]  screenshot.jpg
│   └── [ 58K]  web.jpg
├── [2.5K]  pom.xml
├── [2.0K]  readme.md
└── [4.0K]  src
    └── [4.0K]  main
        ├── [4.0K]  java
        │   └── [4.0K]  com
        │       └── [4.0K]  nibado
        │           └── [4.0K]  example
        │               └── [4.0K]  websocket
        │                   ├── [4.0K]  client
        │                   │   ├── [1.2K]  MySessionHandler.java
        │                   │   └── [1.1K]  ServiceClient.java
        │                   └── [4.0K]  service
        │                       ├── [ 327]  Application.java
        │                       ├── [ 586]  GreetingController.java
        │                       ├── [ 235]  Greeting.java
        │                       ├── [ 129]  HelloMessage.java
        │                       ├── [ 966]  TimeSender.java
        │                       └── [ 985]  WebSocketConfig.java
        └── [4.0K]  resources
            ├── [ 441]  logback.xml
            └── [4.0K]  static
                ├── [ 329]  app.js
                ├── [ 746]  index.html
                └── [ 15K]  stomp.js

12 directories, 16 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!