Spring4Shell Proof Of Concept/And vulnerable application CVE-2022-22965

Spring4Shell - Spring Core RCE - CVE-2022-22965

This is a dockerized application that is vulnerable to the Spring4Shell vulnerability (CVE-2022-22965).

Everything I needed to understand what was going on with "Spring4Shell" - translated source materials, exploit, links to demo apps, and more.

Intentionally Vulnerable to Spring4Shell

《Spring漏洞研究》

CVE-2022-22965 - CVE-2010-1622 redux

This includes CVE-2022-22963, a Spring SpEL / Expression Resource Access Vulnerability, as well as CVE-2022-22965, the spring-webmvc/spring-webflux RCE termed "SpringShell".

Spring4Shell RCE exploit

Lazy SPL to detect Spring4Shell exploitation

Spring4Shell reproduce

Spring4Shell Vulnerability Scanner for Windows

Nmap Spring4Shell NSE script for Spring Boot RCE (CVE-2022-22965)

Advance Spring4Shell RCE Vulnerability Scanner.

This enforces F5 WAF signatures for Spring4Shell and Spring Cloud vulnerabilities across all policies on a BIG-IP ASM device

CVE-2022-22965 (Spring4Shell) Proof of Concept

Vulnerabilidad RCE en Spring Framework vía Data Binding on JDK 9+ (CVE-2022-22965 aka "Spring4Shell")

A vulnerability scanner and exploitation framework targeting Spring, GraphQL, and React Server Components (RSC) stacks. Features dynamic WAF evasion, passive/active auditing, Out-of-Band (OOB) verification, and multi-format enterprise reporting. Built for security researchers and authorized penetration testers.

POC to prove springshell CVE 2022-22965