## https://sploitus.com/exploit?id=48EB895C-64AD-5B2B-A3BA-69DBD7E36642
# Web Framework CVE Vulnerability Reproduction Testbed
> **Warning: This project is intended solely for security research and educational purposes.**
>
> The use of all vulnerability environments and exploit scripts in this repository on unauthorized targets is **strictly prohibited**. Users assume full legal responsibility for any consequences resulting from improper use. Please conduct learning and testing in a lawful and compliant manner.
---
## Project Overview
This repository collects high-risk historical vulnerabilities from multiple mainstream Web frameworks and middleware, and provides a one-click Docker reproduction environment and proof-of-concept (PoC) scripts for each vulnerability. The goal is to help security beginners understand vulnerability principles, exploitation methods, and defense strategies through hands-on practice.
Each vulnerability experiment includes a standalone environment configuration, exploitation script, and detailed documentation, allowing you to practice repeatedly in a secure, isolated local environment.
---
## Prerequisites
Before you begin, please ensure the following tools are installed on your system:
| Tool | Minimum Version | Description |
|------|----------|------|
| Docker | 20.10+ | Container runtime |
| Docker Compose | v2.0+ | Multi-container orchestration (using the `docker-compose` v2 command is recommended) |
| curl | Any version | Sends HTTP requests for PoC scripts |
| bash | 4.0+ | Runs PoC scripts |
In addition, you need to have the following foundational knowledge:
- Basic Linux command-line operations
- Basic concepts of the HTTP protocol
- Basic usage of Docker containers
---
## List of Vulnerabilities
### Spring Framework
| CVE Number | Vulnerability Name | Affected Components | CVSS | Difficulty | Recommendation |
|-----------|----------|----------|----- -|------|------|
| CVE-2022-22965 | Spring4Shell Remote Code Execution | Spring Framework 5.3.x / 5.2.x | 9.8 | Easy | ⭐Recommended |
### Oracle WebLogic
| CVE Number | Vulnerability Name | Affected Components | CVSS | Severity | Recommendation |
|-----------|----------|----------|----- -|------|------|
| CVE-2019-2725 | XMLDecoder Deserialization RCE | WebLogic 10.3.6.0 / 12.1.3.0 | 9.8 | Easy | |
| CVE-2020-2551 | IIOP Protocol Deserialization | WebLogic 10.3.6.0 / 12.1.3.0 / 12.2.1.3-4 | 9.8 | Hard (Proof-of-Concept Only) | |
| CVE-2020-14882 | Console Authentication Bypass | WebLogic 10.3.6.0 / 12.1.3.0 / 12.2.1.3-4 / 14.1.1.0 | 9.8 | Easy | ⭐Recommended |
| CVE-2020-14883 | Post-Authentication Code Execution | WebLogic 10.3.6.0 / 12.1.3.0 / 12.2.1.3-4 / 14.1.1.0 | 7.2 | Medium (when used in conjunction with CVE-2020-14882) | |
| CVE-2023-21839 | T3/IIOP JNDI Injection | WebLogic 12.2.1.3.0 / 12.2.1.4.0 / 14.1.1.0.0 | 7.5 | Medium | |
### GeoServer
| CVE Number | Vulnerability Name | Affected Components | CVSS | Severity | Recommendation |
|-----------|----------|----------|----- -|------|------|
| CVE-2024-36401 | Attribute Name Expression RCE | GeoServer < 2.23.6 / < 2.24.4 | 9.8 | Easy | ⭐Recommended |
### Apache OFBiz
| CVE Number | Vulnerability Name | Affected Components | CVSS | Severity | Recommendation |
|-----------|----------|--------- -|------|------|------|
| CVE-2024-38856 | Unauthorized Code Execution | Apache OFBiz < 18.12.15 | 9.8 | Medium | |
### Drupal
| CVE ID | Vulnerability Name | Affected Components | CVSS | Difficulty | Recommendation |
|-----------|----------|----------|----- -|------|------|
| CVE-2018-7600 | Drupalgeddon2 Remote Code Execution | Drupal 7.x / 8.x | 9.8 | Easy | ⭐Recommended |
### PHP
| CVE Number | Vulnerability Name | Affected Components | CVSS | Severity | Recommendation |
|-----------|----------|----------|------|----- -|------|
| CVE-2024-4577 | PHP CGI Parameter Injection RCE | PHP 8.1.x / 8.2.x / 8.3.x (Windows + CGI mode) | 9.8 | Easy | ⭐Recommended |
---
## Learning Path
We recommend following the order below to gradually master vulnerability reproduction and analysis skills, progressing from basic to advanced:
**Phase 1: Introduction (Recommended vulnerabilities marked with ⭐)**
Reproduce the recommended vulnerabilities in the following order to establish a basic framework for vulnerability analysis:
1. **CVE-2020-14882** — WebLogic Console Authentication Bypass. The exploitation process is straightforward and ideal for understanding path traversal vulnerabilities.
2. **CVE-2018-7600** — Drupalgeddon2. A classic CMS vulnerability that helps illustrate form injection and security issues in the rendering pipeline.
3. **CVE-2024-4577** — PHP CGI Parameter Injection. Demonstrates command injection resulting from differences in parameter parsing; the concept is simple but the impact is severe.
4. **CVE-2022-22965** — Spring4Shell. Understands the Java Bean property binding mechanism and class loader exploitation chains.
5. **CVE-2024-36401** — GeoServer property name expression injection. Learn about security risks in OGC standards and expression evaluation.
**Phase 2: Advanced**
After completing the recommended vulnerabilities, continue by tackling the following medium- and high-difficulty vulnerabilities:
6. **CVE-2019-2725** — WebLogic XMLDecoder deserialization; understand the Java deserialization attack surface.
7. **CVE-2020-14883** — Achieve post-authentication code execution in conjunction with CVE-2020-14882; understand vulnerability chaining.
8. **CVE-2023-21839** — T3/IIOP JNDI Injection: Gain an in-depth understanding of the principles behind JNDI injection attacks.
9. **CVE-2024-38856** — Apache OFBiz Unauthorized Code Execution: Learn about privilege escalation and expression injection.
10. **CVE-2020-2551** — IIOP Protocol Deserialization (conceptual analysis only); understand security issues at the CORBA/IIOP protocol level.
---
## Quick Start
The procedure for each vulnerability lab is essentially the same. Here is an example using a specific vulnerability:
```bash
# Enter the vulnerability directory
cd CVE-XXXX-XXXXX
# Start the test environment
docker compose up -d
# Wait for the service to fully start (usually takes 10–30 seconds)
sleep 15
# Run the exploit script
./poc.sh
# After the experiment, stop and clean up the environment
docker compose down
```
---
## Experiment Directory Structure
Each vulnerability experiment directory (`CVE-XXXX-XXXXX/`) follows a standardized structure:
```
CVE-XXXX-XXXXX/
├── docker-compose.yml # Docker Compose orchestration file defining the target environment services
├── Dockerfile # (Optional) Custom image build file
├── poc.sh # Proof-of-concept script for one-click vulnerability reproduction
└── README.md # Detailed documentation of the vulnerability
```
Description of each file’s purpose:
| File | Description |
|------|------|
| `docker-compose.yml` | Defines container services, port mappings, and dependencies. Start with `docker compose up -d`. |
| `Dockerfile` | Used to build a custom image containing a specific vulnerable version when public images do not meet requirements. |
| `poc.sh` | Proof-of-concept script for exploiting the vulnerability. When run, it automatically sends attack requests and displays the execution results. |
| `README.md` | Contains a description of the vulnerability, affected versions, reproduction steps, analysis of the underlying mechanism, and recommended fixes. |
---
## License and Disclaimer
This project is released under the MIT License.
**Disclaimer:**
- All content in this project is intended solely for security research and authorized testing.
- Users must ensure that any tools and scripts in this project are used within the scope of lawful authorization.
- The project author assumes no liability for any direct or indirect damages resulting from the use of this project’s content.
- Before conducting any security testing, be sure to obtain written authorization from the owner of the target system.
- Unauthorized penetration testing of others’ systems is illegal, and users are solely responsible for any legal consequences.