Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/calumhutton/cve-2022-22965-poc_payara
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingPayload Development
GitHubcalumhutton/cve-2022-22965-poc_payara

CVE-2022-22965-PoC_Payara

Proof-of-concept exploit for CVE-2022-22965 in Payara/Glassfish, demonstrating arbitrary file download via web root manipulation. Includes Docker setup and exploit script.

View Repository
34 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2022-22965 PoC - Payara Arbitrary File Download

Minimal example of how to reproduce CVE-2022-22965 Spring vulnerability in Payara/Glassfish.

Alternative payload for Payara/Glassfish that allows the malicious user to set an arbitrary web root, leading to arbitrary file download.

Run using docker compose

  1. Build the application using Docker compose
    root@kitploit:~
    docker-compose up --build
  2. To test the app browse to http://localhost:8080/handling-form-submission-complete/greeting
  3. Run the exploit
    root@kitploit:~
    ./exploits/run.sh

Conditions

The exploit requires Java 9 or above because module property was added in Java 9.

Download Tool