Exploitation Summary
EIP tracks 5 public exploits for CVE-2010-1622. PoCs published by Meder Kydyraliev, DDuarte, E-bounce.
AI-analyzed exploit summary The writeup describes CVE-2010-1622, a critical vulnerability in the Spring Framework allowing arbitrary code execution by manipulating the class loader's URLs via HTTP parameters. It outlines the attack steps, including crafting a malicious JAR and submitting a specially crafted HTTP request to exploit the vulnerability.
Description
SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.
Exploits (5)
The writeup describes CVE-2010-1622, a critical vulnerability in the Spring Framework allowing arbitrary code execution by manipulating the class loader's URLs via HTTP parameters. It outlines the attack steps, including crafting a malicious JAR and submitting a specially crafted HTTP request to exploit the vulnerability.
This repository contains a functional PoC for CVE-2022-22965, a Spring Framework RCE vulnerability. It includes a vulnerable Spring application and a Python script to exploit it by deploying a JSP webshell via malicious parameter binding.
This repository provides a Dockerized learning environment for CVE-2010-1622, a vulnerability in Apache Tomcat 6.0.26. It includes a Spring MVC application with controllers that demonstrate the vulnerability, allowing users to interact with the environment to understand the exploit mechanics.
The repository contains minimal Spring MVC code demonstrating a basic controller and POJO but lacks any exploit code or technical details related to CVE-2010-1622. No vulnerability demonstration or analysis is present.