CVE-2022-22965 - CVE-2010-1622 redux

Last update: Aug 25, 2022

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

$ docker rm -f rce; docker build -t rce:latest . && docker run -d -p 8080:8080 --name rce rce:latest && sleep 5 && python poc.py

Output example

rce
sha256:f626a2190dc0790c610afd4f12a4b2482b6a726d671fdac1432275de89c07cd6
1a048e5725f754d331de9491d0750c4c7a163472dea1fd1554edccfd00d7f6e5
deploy <Response [200]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [500]>
webshell http://localhost:8080/tomcatwar.jsp?cmd=whoami
root

Identification with Semgrep

$ semgrep --config=semgrep-rule.yml .

Semgrep rule and test cases

Output example

Findings:

  src/main/java/com/example/demo/controller/IndexController.java
     cve-2022-22965
        Semgrep found a match


         14┆ @RequestMapping("/index")
         15┆ public void index(EvalBean evalBean) {
         16┆
         17┆ }

Ran 1 rule on 3 files: 1 finding.

Vulnerable app requirements¹

JDK 9 or above
Standalone Tomcat (no Embedded Tomcat) with WAR deployment
Any Spring version before 5.3.18 / 5.2.20 (Spring Boot before 2.5.12 / 2.6.6)
No blocklist on WebDataBinder / InitBinder
Parameter bind with POJOs directly (no @RequestBody, @RequestQuery, etc.)
Writeable file system (e.g webapps/ROOT)

Sources

Assuming exploits similar to the known PoCs. There might be other gadgets... ↩

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements¹

Sources

Owner

Duarte Duarte

SSLyze is a fast and powerful SSL/TLS scanning tool and Python library.

CC CAMERA HACKING TOOL

Obfuscate ip address using different encodings

LaxrFar Python Obfuscator

A blind SQL injection script that uses binary search aka bisection method to dump datas from database.

A kAFL based hypervisor fuzzer which fully supports nested VMs

🔎 Most Advanced Open Source Intelligence (OSINT) Framework for scanning IP Address, Emails, Websites, Organizations.

Password list generator for password spraying - prebaked with goodies

Malware Configuration And Payload Extraction

Log4j-Scanner with Bind-Receipt and custom hostnames

A windows post exploitation tool that contains a lot of features for information gathering and more.

About Hive Burp Suite Extension

A proof-of-concept exploit for Log4j RCE Unauthenticated (CVE-2021-44228)

TLaunch: Launch Programs on Multiple Hosts

Tenssens framework focused on gathering information from free tools or resources. The intention is to help people find free OSINT resources.

CVE-2021-22005 - VMWare vCenter Server File Upload to RCE

Local server for IDA Lumina feature

Subdomain enumeration,Web scraping and finding usernames automation script written in python

If you are worried about being found perhaps try taking cover under a blanket. Pure Python PowerShell Obfuscator

This repo is about steps to create a effective custom wordlist in a few clicks/

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements1

Sources

Footnotes

Owner

Duarte Duarte

SSLyze is a fast and powerful SSL/TLS scanning tool and Python library.

CC CAMERA HACKING TOOL

Obfuscate ip address using different encodings

LaxrFar Python Obfuscator

A blind SQL injection script that uses binary search aka bisection method to dump datas from database.

A kAFL based hypervisor fuzzer which fully supports nested VMs

🔎 Most Advanced Open Source Intelligence (OSINT) Framework for scanning IP Address, Emails, Websites, Organizations.

Password list generator for password spraying - prebaked with goodies

Malware Configuration And Payload Extraction

Log4j-Scanner with Bind-Receipt and custom hostnames

A windows post exploitation tool that contains a lot of features for information gathering and more.

About Hive Burp Suite Extension

A proof-of-concept exploit for Log4j RCE Unauthenticated (CVE-2021-44228)

TLaunch: Launch Programs on Multiple Hosts

Tenssens framework focused on gathering information from free tools or resources. The intention is to help people find free OSINT resources.

CVE-2021-22005 - VMWare vCenter Server File Upload to RCE

Local server for IDA Lumina feature

Subdomain enumeration,Web scraping and finding usernames automation script written in python

If you are worried about being found perhaps try taking cover under a blanket. Pure Python PowerShell Obfuscator

This repo is about steps to create a effective custom wordlist in a few clicks/

Vulnerable app requirements¹