Skip to content

Commit 187fd9f

Browse files
author
0
committed
chore: initialize repository standards with community templates and enhance CVE coverage documentation
1 parent 34f048d commit 187fd9f

8 files changed

Lines changed: 359 additions & 20 deletions

File tree

‎.github/ISSUE_TEMPLATE/bug_report.md‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
name: Bug Report
3+
about: Report a bug or unexpected behavior in Spring2Shell.
4+
title: '[BUG] '
5+
labels: bug
6+
assignees: ''
7+
8+
---
9+
10+
**Describe the bug**
11+
A clear and concise description of what the bug is.
12+
13+
**To Reproduce**
14+
Steps to reproduce the behavior. Please provide the exact command line executed (with sensitive target IPs/domain names masked):
15+
```bash
16+
python3 -m spring2shell <subcommand> <args...>
17+
```
18+
19+
**Expected Behavior**
20+
A clear and concise description of what you expected to happen.
21+
22+
**Screenshots / Logs / Console Output**
23+
If applicable, add screenshots or copy-paste terminal logs/tracebacks to help explain your problem.
24+
Run the command with `--verbose-errors` if applicable to capture underlying stack traces:
25+
```text
26+
(Paste logs or stack traces here)
27+
```
28+
29+
**Environment (please complete the following information):**
30+
- OS: (e.g. Ubuntu 22.04, Kali Linux)
31+
- Python Version: (e.g. 3.10.12)
32+
- Spring2Shell Version / Commit hash: (e.g. 2.0.0 or commit `a1b2c3d`)
33+
- Installation Method: (e.g. `pip install -e .`, source clone, Docker)
34+
35+
**Additional Context**
36+
Add any other context about the problem here (e.g. proxy configuration, target WAF behaviors).

‎.github/ISSUE_TEMPLATE/feature_request.md‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
name: Feature Request
3+
about: Suggest an idea, new CVE check, or feature enhancement for Spring2Shell.
4+
title: '[FEATURE] '
5+
labels: enhancement
6+
assignees: ''
7+
8+
---
9+
10+
**Is your feature request related to a problem? Please describe.**
11+
A clear and concise description of what the problem is. (e.g. "I cannot parse target outputs from this specific system because...")
12+
13+
**Describe the solution you'd like**
14+
A clear and concise description of what you want to happen. If suggesting a new vulnerability check/CVE target, please include links to advisories, write-ups, or public POCs if available.
15+
16+
**Describe alternatives you've considered**
17+
A clear and concise description of any alternative solutions or workarounds you've considered.
18+
19+
**Additional Context**
20+
Add any other context, CLI flags ideas, payload formats, or mock screenshots about the feature request here.

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
## Description
2+
3+
Please include a summary of the changes and the related issue/motivation. List any dependencies that are required for this change.
4+
5+
Fixes # (issue)
6+
7+
## Type of Change
8+
9+
Please delete options that are not relevant:
10+
11+
- [ ] Bug fix (non-breaking change which fixes an issue)
12+
- [ ] New feature (non-breaking change which adds functionality)
13+
- [ ] New vulnerability signature / payload module
14+
- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
15+
- [ ] Documentation update
16+
17+
## How Has This Been Tested?
18+
19+
Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration.
20+
21+
- [ ] Run Unit Tests: `make test-unit`
22+
- [ ] Run Integration Tests: `make test-integration`
23+
- [ ] Manual CLI Verification: (describe target environment or test command)
24+
25+
## Checklist:
26+
27+
- [ ] My code follows the style guidelines of this project (run `make check` to verify).
28+
- [ ] I have run `make format` to format the code correctly.
29+
- [ ] I have run `make lint` to check for lints.
30+
- [ ] I have run `make typecheck` to verify type safety.
31+
- [ ] I have performed a self-review of my own code.
32+
- [ ] I have commented my code, particularly in hard-to-understand areas.
33+
- [ ] I have made corresponding changes to the documentation (e.g. updating `README.md` for new CLI flags).
34+
- [ ] My changes generate no new warnings.
35+
- [ ] I have added tests that prove my fix is effective or that my feature works.
36+
- [ ] New and existing unit tests pass locally with my changes (run `make test` to verify).
37+
- [ ] Any dependent changes have been merged and published in downstream modules.

‎CODE_OF_CONDUCT.md‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
# Contributor Covenant Code of Conduct
2+
3+
## Our Pledge
4+
5+
We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, caste, color, religion, or sexual identity and orientation.
6+
7+
We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community.
8+
9+
## Our Standards
10+
11+
Examples of behavior that contributes to a positive environment for our community include:
12+
13+
* Demonstrating empathy and kindness toward other people
14+
* Being respectful of differing opinions, viewpoints, and experiences
15+
* Giving and gracefully accepting constructive feedback
16+
* Accepting responsibility and apologizing to those affected by our mistakes, and learning from the experience
17+
* Focusing on what is best for the overall community, not just for ourselves
18+
19+
Examples of unacceptable behavior include:
20+
21+
* The use of sexualized language or imagery, and unwelcome sexual attention or advances
22+
* Trolling, insulting or derogatory comments, and personal or political attacks
23+
* Public or private harassment
24+
* Publishing others' private information, such as a physical or email address, without their explicit permission
25+
* Other conduct which could reasonably be considered inappropriate in a professional setting
26+
27+
## Enforcement Responsibilities
28+
29+
Community leaders are responsible for clarifying and enforcing our standards of acceptable behavior and will take appropriate and fair corrective action in response to any behavior that they deem inappropriate, threatening, offensive, or harmful.
30+
31+
Community leaders have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, and will communicate reasons for moderation decisions when appropriate.
32+
33+
## Scope
34+
35+
This Code of Conduct applies within all community spaces, and also applies when an individual is officially representing the community in public spaces. Examples of representing our community include using an official e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event.
36+
37+
## Enforcement
38+
39+
Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the community leaders responsible for enforcement at **maintainer@c00ln3t.org**. All complaints will be reviewed and investigated promptly and fairly.
40+
41+
All community leaders are obligated to respect the privacy and security of the reporter of any incident.
42+
43+
## Enforcement Guidelines
44+
45+
Community leaders will follow these Community Impact Guidelines in determining the consequences for any action they deem in violation of this Code of Conduct:
46+
47+
### 1. Correction
48+
49+
**Community Impact**: Use of inappropriate language or other behavior deemed unprofessional or unwelcome in the community.
50+
51+
**Consequence**: A private, written warning from community leaders, providing clarity around the nature of the violation and an explanation of why the behavior was inappropriate. A public apology may be requested.
52+
53+
### 2. Warning
54+
55+
**Community Impact**: A violation through a single incident or series of actions.
56+
57+
**Consequence**: A warning with consequences for continued behavior. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period of time. This includes avoiding interactions in community spaces as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban.
58+
59+
### 3. Temporary Ban
60+
61+
**Community Impact**: A serious violation of community standards, including sustained harassing behavior.
62+
63+
**Consequence**: A temporary ban from any sort of interaction or public communication with the community for a specified period of time. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban.
64+
65+
### 4. Permanent Ban
66+
67+
**Community Impact**: Demonstrating a pattern of violation of community standards, including sustained harassing behavior, harassment of an individual, or aggression toward or disparagement of classes of people.
68+
69+
**Consequence**: A permanent ban from any sort of public interaction within the community.
70+
71+
## Attribution
72+
73+
This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 2.1, available at [https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][version].
74+
75+
Community Impact Guidelines were inspired by [Mozilla's code of conduct enforcement ladder][mozilla].
76+
77+
[homepage]: https://www.contributor-covenant.org
78+
[version]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
79+
[mozilla]: https://github.com/mozilla/diversity

‎CONTRIBUTING.md‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
# Contributing to Spring2Shell
2+
3+
Thank you for your interest in contributing to **Spring2Shell**! Contributions from the security research and developer community are vital to keeping this project robust, performant, and up-to-date.
4+
5+
Please read our [Code of Conduct](CODE_OF_CONDUCT.md) before participating in this project.
6+
7+
---
8+
9+
## 📖 Table of Contents
10+
11+
1. [Our Policy on Responsible Disclosure](#🛡️-our-policy-on-responsible-disclosure)
12+
2. [How Can I Contribute?](#how-can-i-contribute)
13+
3. [Local Development Setup](#local-development-setup)
14+
4. [Code Quality & Linting](#code-quality--linting)
15+
5. [Testing Guidelines](#testing-guidelines)
16+
6. [Pull Request Process](#pull-request-process)
17+
18+
---
19+
20+
## 🛡️ Our Policy on Responsible Disclosure
21+
22+
Because Spring2Shell is a vulnerability scanner and security assessment tool:
23+
- **Do NOT open public issues for security vulnerabilities found within Spring2Shell itself.**
24+
- Instead, please refer to our [Security Policy](SECURITY.md) for details on how to report vulnerabilities privately.
25+
26+
---
27+
28+
## How Can I Contribute?
29+
30+
* **Reporting Bugs:** First, search the existing issues. If your problem hasn't been reported, open an issue using the **Bug Report** template.
31+
* **Suggesting Features:** Open an issue using the **Feature Request** template, detailing the proposed change and its benefits.
32+
* **Adding Payloads / Signatures:** We welcome PRs that update `data/payloads/cve_payloads.json` to cover new CVEs or add evasion techniques.
33+
* **Submitting Pull Requests:** Fix open issues or implement approved feature requests.
34+
35+
---
36+
37+
## Local Development Setup
38+
39+
To set up a local development environment:
40+
41+
1. **Fork and Clone** the repository:
42+
```bash
43+
git clone https://github.com/your-username/Spring2Shell.git
44+
cd Spring2Shell
45+
```
46+
47+
2. **Set up a Virtual Environment**:
48+
```bash
49+
make venv
50+
source .venv/bin/activate
51+
```
52+
53+
3. **Install Dependencies in Editable Mode**:
54+
```bash
55+
make install-dev
56+
```
57+
58+
---
59+
60+
## Code Quality & Linting
61+
62+
We maintain high code quality and strict formatting standards using `ruff` and `mypy`. Before submitting a pull request, ensure your code passes all checks:
63+
64+
- **Format Code**:
65+
```bash
66+
make format
67+
```
68+
- **Lint Code**:
69+
```bash
70+
make lint
71+
```
72+
- **Type Checking**:
73+
```bash
74+
make typecheck
75+
```
76+
- **Run All Quality Checks**:
77+
```bash
78+
make check
79+
```
80+
81+
---
82+
83+
## Testing Guidelines
84+
85+
We use `pytest` for unit and integration testing. Any new features or bug fixes must include corresponding tests.
86+
87+
- **Run all tests (with coverage report)**:
88+
```bash
89+
make test
90+
```
91+
- **Run unit tests only**:
92+
```bash
93+
make test-unit
94+
```
95+
- **Run integration tests only**:
96+
```bash
97+
make test-integration
98+
```
99+
100+
Ensure that coverage does not drop as a result of your contribution.
101+
102+
---
103+
104+
## Pull Request Process
105+
106+
1. **Branch Naming**: Use descriptive branch names (e.g., `feature/add-cve-2026-xxxx` or `fix/connection-timeout`).
107+
2. **Commit Messages**: Write clear, descriptive commit messages matching standard conventions (e.g., `feat: add scanner support for CVE-2026-XYZ`).
108+
3. **Update Documentation**: If your change introduces new flags, CLI modes, or configuration values, update the `README.md` and relevant help screens.
109+
4. **Pass CI/CD**: Ensure all tests and lints pass.
110+
5. **Open Pull Request**: Fill out the provided [Pull Request Template](.github/PULL_REQUEST_TEMPLATE.md) completely so the maintainers can review your changes efficiently.

‎README.md‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -90,19 +90,19 @@ graph TD
9090

9191
`Spring2Shell` contains an externalized, up-to-date payload database (`data/payloads/cve_payloads.json`) targeting the following vectors:
9292

93-
| CVE ID | Vulnerability / Description | Affected Technology | Type | Variants |
94-
| :--- | :--- | :--- | :--- | :---: |
95-
| **CVE-2025-55182** | SpEL Injection (GraphQL/Spring Endpoints) | Spring Framework | Remote Code Execution | 8 |
96-
| **CVE-2025-66478** | GraphQL-specific SpEL injection vectors | Spring + GraphQL | Remote Code Execution | 3 |
97-
| **CVE-2022-22965** | Spring4Shell (ClassLoader Data Binding RCE) | Spring Framework | Remote Code Execution | 2 |
98-
| **CVE-2021-44228** | Log4Shell (JNDI LDAP/RMI Injection) | Apache Log4j 2 | Remote Code Execution | 6 |
99-
| **CVE-2022-42889** | Text4Shell (Commons Text Interpolation) | Apache Commons Text | Remote Code Execution | 3 |
100-
| **CVE-2023-46604** | ActiveMQ OpenWire Deserialization RCE | Apache ActiveMQ | Remote Code Execution | 4 |
101-
| **CVE-2024-22243** | Spring Web SSRF via UriComponentsBuilder | Spring Framework | SSRF | 7 |
102-
| **CVE-2024-38816** | WebFlux Directory Traversal (Linux pathing) | Spring Framework | Path Traversal | 7 |
103-
| **CVE-2024-4577** | PHP CGI Argument Injection (Windows/XAMPP) | PHP CGI | Remote Code Execution | 4 |
104-
| **CVE-2023-34104** | fast-xml-parser ReDoS / Prototype Pollution | fast-xml-parser | ReDoS / Pollution | 3 |
105-
| **CVE-2024-21626** | runc Container Escape (/proc/self/fd leak) | runc | Container Escape | 3 |
93+
| CVE ID | Vulnerability / Description | Affected Technology | Type | Severity | Variants |
94+
| :--- | :--- | :--- | :--- | :---: | :---: |
95+
| **[CVE-2025-55182](https://nvd.nist.gov/vuln/detail/CVE-2025-55182)** | SpEL Injection (GraphQL/Spring Endpoints) | Spring Framework | 🔴 RCE | 💥 Critical | `8` |
96+
| **[CVE-2025-66478](https://nvd.nist.gov/vuln/detail/CVE-2025-66478)** | GraphQL-specific SpEL injection vectors | Spring + GraphQL | 🔴 RCE | 💥 Critical | `3` |
97+
| **[CVE-2022-22965](https://nvd.nist.gov/vuln/detail/CVE-2022-22965)** | Spring4Shell (ClassLoader Data Binding RCE) | Spring Framework | 🔴 RCE | 💥 Critical | `2` |
98+
| **[CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228)** | Log4Shell (JNDI LDAP/RMI Injection) | Apache Log4j 2 | 🔴 RCE | 💥 Critical | `6` |
99+
| **[CVE-2022-42889](https://nvd.nist.gov/vuln/detail/CVE-2022-42889)** | Text4Shell (Commons Text Interpolation) | Apache Commons Text | 🔴 RCE | 💥 Critical | `3` |
100+
| **[CVE-2023-46604](https://nvd.nist.gov/vuln/detail/CVE-2023-46604)** | ActiveMQ OpenWire Deserialization RCE | Apache ActiveMQ | 🔴 RCE | 💥 Critical | `4` |
101+
| **[CVE-2024-22243](https://nvd.nist.gov/vuln/detail/CVE-2024-22243)** | Spring Web SSRF via UriComponentsBuilder | Spring Framework | 🟡 SSRF | ⚠️ High | `7` |
102+
| **[CVE-2024-38816](https://nvd.nist.gov/vuln/detail/CVE-2024-38816)** | WebFlux Directory Traversal (Linux pathing) | Spring Framework | 🟠 Path Traversal | ⚠️ High | `7` |
103+
| **[CVE-2024-4577](https://nvd.nist.gov/vuln/detail/CVE-2024-4577)** | PHP CGI Argument Injection (Windows/XAMPP) | PHP CGI | 🔴 RCE | 💥 Critical | `4` |
104+
| **[CVE-2023-34104](https://nvd.nist.gov/vuln/detail/CVE-2023-34104)** | fast-xml-parser ReDoS / Prototype Pollution | fast-xml-parser | ⚡ ReDoS/Pollution | ⚠️ High | `3` |
105+
| **[CVE-2024-21626](https://nvd.nist.gov/vuln/detail/CVE-2024-21626)** | runc Container Escape (/proc/self/fd leak) | runc | 🟣 Escape | ⚠️ High | `3` |
106106

107107
---
108108

‎SECURITY.md‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
# Security Policy
2+
3+
We take the security of **Spring2Shell** seriously. As a tool designed to perform security audits, keeping Spring2Shell itself safe and secure is of paramount importance.
4+
5+
This document outlines how to report vulnerabilities found within the Spring2Shell codebase or dependencies, and which versions are actively supported.
6+
7+
---
8+
9+
## Supported Versions
10+
11+
Only the latest major/minor releases receive security updates and patches.
12+
13+
| Version | Supported |
14+
| ------- | --------- |
15+
| 2.0.x | Yes (Active) |
16+
| 1.0.x | No |
17+
18+
Please ensure you are running the latest version of Spring2Shell before reporting a potential issue.
19+
20+
---
21+
22+
## Reporting a Vulnerability
23+
24+
**Please do NOT report security vulnerabilities via public GitHub issues.**
25+
26+
If you discover a vulnerability or security-related bug in this project, please report it responsibly using one of the following methods:
27+
28+
1. **GitHub Private Vulnerability Reporting:**
29+
- Navigate to the "Security" tab of the repository on GitHub.
30+
- Click on "Advisories" in the left sidebar.
31+
- Click "Report a vulnerability" to open a private draft advisory.
32+
33+
2. **Direct Email:**
34+
- Alternatively, email details of the vulnerability to **maintainer@c00ln3t.org**.
35+
- If possible, encrypt your message using PGP (key fingerprint or details can be requested via email first).
36+
37+
### What to Include in Your Report
38+
39+
To help us triage and resolve the issue quickly, please include:
40+
- A detailed description of the vulnerability.
41+
- Steps to reproduce (including configuration files, command line flags, or payloads if applicable).
42+
- A proof of concept (PoC) code snippet or command.
43+
- The potential impact (e.g., local file read, denial of service, remote code execution).
44+
- Any details on how this affects specific environments or dependencies.
45+
46+
---
47+
48+
## Our Process
49+
50+
Upon receiving a report, we will:
51+
1. **Acknowledge** receipt of the report within **48 hours**.
52+
2. **Triage** the vulnerability and confirm the impact.
53+
3. **Collaborate** with the reporter to develop a patch or mitigation.
54+
4. **Publish** a security advisory and release a patched version (aiming for release within **30 days** of initial triage).
55+
5. **Credit** the reporter in our release notes and changelog (unless requested otherwise).
56+
57+
Thank you for helping keep Spring2Shell secure!

‎docs/cve_coverage.md‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,13 @@
22

33
Current payload coverage in `data/payloads/cve_payloads.json`.
44

5-
| CVE | Vulnerability | Affected Software | Payload Variants |
6-
|---|---|---|---|
7-
| **CVE-2025-55182** | SpEL Injection — RCE via GraphQL/Spring endpoints | Spring Framework | 8 |
8-
| **CVE-2025-66478** | GraphQL-specific SpEL injection | Spring + GraphQL | 3 |
9-
| **CVE-2022-22965** | Spring4Shell — ClassLoader data binding RCE | Spring Framework < 5.3.18, < 5.2.20 | 2 |
10-
| **CVE-2021-44228** | Log4Shell — JNDI injection | Apache Log4j 2.0-beta9 to 2.14.1 | 6 |
11-
| **CVE-2022-42889** | Text4Shell — Commons Text interpolation RCE | Apache Commons Text < 1.10.0 | 3 |
5+
| CVE | Vulnerability | Affected Software | Type | Severity | Payload Variants |
6+
|---|---|---|---|---|---|
7+
| **[CVE-2025-55182](https://nvd.nist.gov/vuln/detail/CVE-2025-55182)** | SpEL Injection — RCE via GraphQL/Spring endpoints | Spring Framework | 🔴 RCE | 💥 Critical | `8` |
8+
| **[CVE-2025-66478](https://nvd.nist.gov/vuln/detail/CVE-2025-66478)** | GraphQL-specific SpEL injection | Spring + GraphQL | 🔴 RCE | 💥 Critical | `3` |
9+
| **[CVE-2022-22965](https://nvd.nist.gov/vuln/detail/CVE-2022-22965)** | Spring4Shell — ClassLoader data binding RCE | Spring Framework < 5.3.18, < 5.2.20 | 🔴 RCE | 💥 Critical | `2` |
10+
| **[CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228)** | Log4Shell — JNDI injection | Apache Log4j 2.0-beta9 to 2.14.1 | 🔴 RCE | 💥 Critical | `6` |
11+
| **[CVE-2022-42889](https://nvd.nist.gov/vuln/detail/CVE-2022-42889)** | Text4Shell — Commons Text interpolation RCE | Apache Commons Text < 1.10.0 | 🔴 RCE | 💥 Critical | `3` |
1212

1313
## Adding Coverage for a New CVE
1414

0 commit comments

Comments
 (0)