Spring Data MongoDB SpEL Injection [CVE-2022-22980]

[jheysel-r7]

Summary

This module will exploit a SpEL injection vulnerability in Spring Data MongoDB

Basic example

https://github.com/kuron3k0/Spring-Data-Mongodb-Example

[jheysel-r7]

I jumped the gun on creating this issue. The successful exploitation of this vulnerability requires knowledge of a specific vulnerable endpoint. In the PoC's test application the endpoint /v1/user is configured to be vulnerable however in real world applications the user would first have to find a vulnerable endpoint via whitebox analysis or some prior knowledge, making this a non-ideal candidate for a metasploit module.