Exploitation Summary
EIP tracks 3 public exploits for CVE-2024-22243. PoCs published by SeanPesce, shellfeel, Reivap.
AI-analyzed exploit summary This repository contains a functional proof-of-concept demonstrating CVE-2024-22243, a URL-parsing vulnerability in Spring Framework that can lead to open redirect and SSRF due to abnormal handling of the 'userinfo' segment in URLs. The included Java web application provides exploitable endpoints to showcase the vulnerability.
Description
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.
Exploits (3)
This repository contains a functional proof-of-concept demonstrating CVE-2024-22243, a URL-parsing vulnerability in Spring Framework that can lead to open redirect and SSRF due to abnormal handling of the 'userinfo' segment in URLs. The included Java web application provides exploitable endpoints to showcase the vulnerability.
This repository contains a functional Spring Boot application demonstrating CVE-2024-22243 and CVE-2024-22234, likely related to authentication bypass or SSRF via URI parsing flaws. The `/vul` endpoint and `UriComponentsBuilder` usage in `IndexController` suggest exploitation of improper URI validation.
The repository contains only a README.md file with minimal content, referencing another user (@SeanPesce) without providing any exploit code or technical details. It lacks substance and does not demonstrate functionality or analysis.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N