#Spring4ShellScan #Fully #Automated #Reliable #Accurate #Scanner #Finding #Spring4Shell
Spring4Shell-Scan is a fully automated, reliable, and accurate scanner for finding Spring4Shell and Spring Cloud RCE vulnerabilities.
- Support for lists of URLs.
- Fuzzing for more than 10 new Spring4Shell payloads (previously seen tools uses only 1-2 variants).
- Fuzzing for HTTP GET and POST methods.
- Automatic validation of the vulnerability upon discovery.
- Randomized and non-intrusive payloads.
- WAF Bypass payloads.
The Spring4Shell RCE is a critical vulnerability that FullHunt has been researching since it was released. We worked with our customers in scanning their environments for Spring4Shell and Spring Cloud RCE vulnerabilities.
We’re open-sourcing an open detection scanning tool for discovering Spring4Shell (CVE-2022-22965) and Spring Cloud RCE (CVE-2022-22963) vulnerabilities. This shall be used by security teams to scan their infrastructure, as well as test for WAF bypasses that can result in achieving successful exploitation of the organization’s environment.
If your organization requires help, please contact (team at fullhunt.io) directly for a full attack surface discovery and scanning for the Spring4Shell vulnerabilities.
$ ./spring4shell-scan.py -h
[•] CVE-2022-22965 – Spring4Shell RCE Scanner
[•] Scanner provided by FullHunt.io – The Next-Gen Attack Surface Management Platform.
[•] Secure your External Attack Surface with FullHunt.io.
usage: spring4shell-scan.py [-h] [-u URL] [-p PROXY] [-l USEDLIST] [–payloads-file PAYLOADS_FILE] [–waf-bypass] [–request-type REQUEST_TYPE] [–test-CVE-2022-22963]
-h, –help show this help message and exit
-u URL, –url URL Check a single URL.
-p PROXY, –proxy PROXY
Send requests through proxy
-l USEDLIST, –list USEDLIST
Check a list of URLs.
Payloads file – [default: payloads.txt].
–waf-bypass Extend scans with WAF bypass payloads.
Request Type: (get, post, all) – [Default: all].
Test for CVE-2022-22963 (Spring Cloud RCE).
Scan a Single URL
$ python3 spring4shell-scan.py -u https://spring4shell.lab.secbot.local
Discover WAF bypasses against the environment
$ python3 spring4shell-scan.py -u https://spring4shell.lab.secbot.local –waf-bypass
Scan a list of URLs
$ python3 spring4shell-scan.py -l urls.txt
Include checks for Spring Cloud RCE (CVE-2022-22963)
$ python3 spring4shell-scan.py -l urls.txt –test-CVE-2022-22963
$ pip3 install -r requirements.txt
git clone https://github.com/fullhunt/spring4shell-scan.git
sudo docker build -t spring4shell-scan .
sudo docker run -it –rm spring4shell-scan
With URL list “urls.txt” in current directory
docker run -it –rm -v $PWD:/data spring4shell-scan -l /data/urls.txt