chrisley75/code-xploitation repository overview

Image base on Vulnerable Spring application (CVE-2022-22965)

The vulnerable Spring application contains a GET and POST request handler for /helloworld/greeting. The exploit.sh uses curl to write a webshell to http://:8080/shell.jsp. The shell can be used to grab the flag present at /flag inside the container's filesystem or move further into the infrastructure.

CVE-2022-22965 The CVE-2022-22965 with a CVSS score of 9.8 has been to the vulnerability in Spring Core allowing Remote Code Execution. The exploit is easy to achieve and hence the high CVSS score, pre-requisites for the exploit are:

JDK version 9+ Application built on Spring Or derived frameworks Running Tomcat with WAR deployment

https://github.com/FourCoreLabs/spring4shell-exploit-poc⁠