Vulnerable Spring DataRest App

This is an intentionally Spring Data REST Application to test and demostrate the CVE-2017-8046 vulnerability and the challenges of testing Command Injection and Remote Code Execution via REST apis

It has support for Swagger UI to use with tools where Swagger documention helps discovery and spidering, such as the OWASP Zend Attack Proxy (ZAP) plugin for Swagger

To use

• clone the repository locally
• build using maven
• run on

For more details on how this project was used in a pentesting exercise, see