.. / CVE-2020-5405

Exploit for Spring Cloud Config - Local File Inclusion (CVE-2020-5405)

Description:

Spring Cloud Config versions 2.2.x prior to 2.2.2, 2.1.x prior to 2.1.7, and older unsupported versions are vulnerable to local file inclusion because they allow applications to serve arbitrary configuration files through the spring-cloud-config-server module.

Nuclei Template

View the template here CVE-2020-5405.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2020/CVE-2020-5405.yaml
Copy

References:

https://pivotal.io/security/cve-2020-5405
https://nvd.nist.gov/vuln/detail/CVE-2020-5405
https://github.com/Secxt/FINAL
https://github.com/pen4uin/vulnerability-research-list
https://github.com/sobinge/nuclei-templates