X-SpringBoot through 6.0 Credential Exposure via Unauthenticated Endpoint
33Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 6.9epss 0.3%
probabilidade de exploração
0.3%top 78% das CVEs
exploração observada
nãonenhuma fonte reporta
1 exploit(s) público(s)
X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider, enabling SMS bombing and impersonation attacks.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
yzcheng90 · X-SpringBootPoCs públicas encontradas — 1
cve_referencegithub.com/LinYuanyi1/cve-request-poc/blob/master/x-springboot/01_app-credential-sms-abuse.pynão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
https://github.com/LinYuanyi1/cve-request-poc/blob/master/x-springboot/01_app-credential-sms-abuse.pyhttps://github.com/yzcheng90/X-SpringBoothttps://github.com/yzcheng90/X-SpringBoot/blob/d74ddba989c0449948ff1ddb0d211b6a7ce81bfa/src/main/java/com/suke/czx/modules/application/controller/XApplicationController.java#L59-L64https://www.vulncheck.com/advisories/x-springboot-through-6.0-credential-exposure-via-unauthenticated-endpoint