Vuln Java API

Spring Boot vulnerable surface for Log4Shell, XXE, deserialization and disclosure flows.

User header is logged by Log4j.

Log4Shell

Parses XML with unsafe entity settings.

XXE

Accepts serialized object bytes.

Insecure Deserialization

Reads arbitrary paths from query string.

Path Traversal

Try: /api/version, /api/xml, /api/files?path=/app, /api/env, /health