Spring Boot Vulnerability Exploit Check List

Collection of Spring Boot related vulnerability learning materials, exploitation methods and techniques, black-box security assessment check list

Statement

⚠️ All content in this project is only for security research and authorized testing. Those who misuse or abuse this project bear no responsibility for any damages caused

Table of Contents

• Spring Boot Vulnerability Exploit Check List
  • 0: Routes and Versions
    • 0x01: Route Knowledge
    • 0x02: Version Knowledge
      • Dependencies between Component Versions:
      • Dependencies between Spring Cloud and Spring Boot Versions:
      • Suffixes and Meanings of Spring Cloud Minor Versions:
  • 1: Information Disclosure
    • 0x01: Route Address and Interface Call Details Leakage
    • 0x02: Routes Exposed Due to Misconfiguration
    • 0x03: Obtain Plaintext of Password Masked with Asterisks (Method 1)
      • Conditions for Exploitation:
      • Exploitation Method:
        • Step 1: Find the desired property name
        • Step 2: Use jolokia to call the relevant Mbean to obtain plaintext
    • 0x04: Obtain Plaintext of Password Masked with Asterisks (Method 2)
      • Conditions for Exploitation:
      • Exploitation Method:
        • Step 1: Find the desired property name
        • Step 2: Use nc to listen for HTTP requests
        • Step 3: Set the eureka.client.serviceUrl.defaultZone property
        • Step 4: Refresh configuration
        • Step 5: Decode the property value
    • 0x05: Obtain Plaintext of Password Masked with Asterisks (Method 3)
      • Conditions for Exploitation:
      • Exploitation Method:
        • Step 1: Find the desired property name
        • Step 2: Use nc to listen for HTTP requests
        • Step 3: Trigger an external HTTP request
        • Step 4: Refresh configuration
    • 0x06: Obtain Plaintext of Password Masked with Asterisks (Method 4)
      • Conditions for Exploitation:
      • Exploitation Method:
        • Step 1: Find the desired property name
        • Step 2: Download jvm heap information
        • Step 3: Use MAT to obtain the password plaintext from the jvm heap
  • 2: Remote Code Execution
    • 0x01: whitelabel error page SpEL RCE
      • Conditions for Exploitation:
      • Exploitation Method:
        • Step 1: Find a normal parameter passing location
        • Step 2: Execute SpEL expression
      • Vulnerability Principle:
      • Vulnerability Analysis:
      • Vulnerability Environment:
    • 0x02: spring cloud SnakeYAML RCE
      • Conditions for Exploitation:
      • Exploitation Method:
        • Step 1: Host yml and jar files
        • Step 2: Set the spring.cloud.bootstrap.location property
        • Step 3: Refresh configuration
      • Vulnerability Principle:
      • Vulnerability Analysis:
      • Vulnerability Environment:
    • 0x03: eureka xstream deserialization RCE
      • Conditions for Exploitation:
      • Exploitation Method:
        • Step 1: Set up a website that responds with malicious XStream payload
        • Step 2: Listen for reverse shell port
        • Step 3: Set the eureka.client.serviceUrl.defaultZone property
        • Step 4: Refresh configuration
      • Vulnerability Principle:
      • Vulnerability Analysis:
      • Vulnerability Environment:
    • 0x04: jolokia logback JNDI RCE
      • Conditions for Exploitation:
      • Exploitation Method:
        • Step 1: View existing MBeans
        • Step 2: Host xml file
        • Step 3: Prepare Java code to execute
        • Step 4: Set up malicious ldap service
        • Step 5: Listen for reverse shell port
        • Step 6: Load log configuration file from external URL
      • Vulnerability Principle:
      • Vulnerability Analysis:
      • Vulnerability Environment:
    • 0x05: jolokia Realm JNDI RCE
      • Conditions for Exploitation:
      • Exploitation Method:
        • Step 1: View existing MBeans
        • Step 2: Prepare Java code to execute
        • Step 3: Host class file
        • Step 4: Set up malicious rmi service
        • Step 5: Listen for reverse shell port
        • Step 6: Send malicious payload
      • Vulnerability Principle:
      • Vulnerability Analysis:
      • Vulnerability Environment: