CVE-2018-1270
CRITICALSpring Framework < 4.3.16 and 5.0 < 5.0.5 - Remote Code Execution via STOMP over WebSocket
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2018-1270. PoCs published by CaledoniaProject, Venscor, tafamace.
AI-analyzed exploit summary This repository contains a functional proof-of-concept for CVE-2018-1270, demonstrating remote code execution via SpEL injection in Spring Messaging's STOMP selector. The exploit leverages a malicious selector in a WebSocket subscription to execute arbitrary commands.
Description
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.
Exploits (4)
This repository contains a functional proof-of-concept for CVE-2018-1270, demonstrating remote code execution via SpEL injection in Spring Messaging's STOMP selector. The exploit leverages a malicious selector in a WebSocket subscription to execute arbitrary commands.
This repository demonstrates CVE-2018-1270, a Spring WebSocket STOMP message broker vulnerability allowing SpEL injection for RCE. The PoC includes a Spring Boot application with WebSocket configuration and a client-side JavaScript exploit.
The provided code is a simple Java stub that prints command-line arguments and does not demonstrate any exploit functionality for CVE-2018-1270. It lacks any offensive techniques or vulnerability-specific logic.
This PoC exploits CVE-2018-1270, a Spring Data Commons remote code execution vulnerability via STOMP over WebSocket. It constructs a malicious SpEL expression in the 'selector' header to execute arbitrary commands.
References (16)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H