CVE-2022-22965 - CVE-2010-1622 redux

Last update: Aug 25, 2022

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

$ docker rm -f rce; docker build -t rce:latest . && docker run -d -p 8080:8080 --name rce rce:latest && sleep 5 && python poc.py

Output example

rce
sha256:f626a2190dc0790c610afd4f12a4b2482b6a726d671fdac1432275de89c07cd6
1a048e5725f754d331de9491d0750c4c7a163472dea1fd1554edccfd00d7f6e5
deploy <Response [200]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [500]>
webshell http://localhost:8080/tomcatwar.jsp?cmd=whoami
root

Identification with Semgrep

$ semgrep --config=semgrep-rule.yml .

Semgrep rule and test cases

Output example

Findings:

  src/main/java/com/example/demo/controller/IndexController.java
     cve-2022-22965
        Semgrep found a match


         14┆ @RequestMapping("/index")
         15┆ public void index(EvalBean evalBean) {
         16┆
         17┆ }

Ran 1 rule on 3 files: 1 finding.

Vulnerable app requirements¹

JDK 9 or above
Standalone Tomcat (no Embedded Tomcat) with WAR deployment
Any Spring version before 5.3.18 / 5.2.20 (Spring Boot before 2.5.12 / 2.6.6)
No blocklist on WebDataBinder / InitBinder
Parameter bind with POJOs directly (no @RequestBody, @RequestQuery, etc.)
Writeable file system (e.g webapps/ROOT)

Sources

Assuming exploits similar to the known PoCs. There might be other gadgets... ↩

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements¹

Sources

Owner

Duarte Duarte

Threat research and reporting from IronNet's Threat Research Teams

SecurAID securely connects aid organizations directly with individuals in dangerous situations to allow them to discreetly and effectively get the assistance they need.

Bug Alert: a service for alerting security and IT professionals of high-impact and 0day vulnerabilities

Installation of hacking tools

A collection of over 5.1 million sub-domains and assets belonging to public bug bounty programs, compiled into a repo, for performing bulk operations.

EMBArk - The firmware security scanning environment

JumpServer远程代码执行漏洞检测利用脚本

Detection And Breaking With Python

Um keylogger que se disfarça de um app que tira print da tela.

Simple and easy framework for phishing 🎣

AmiEviL - This program uses the Virus Total API to determine if your suspicious file is malicious or not

🔍 IRIS: An open-source intelligence framework

Multi-Process Vulnerability Tool

对安卓APP注入MSF PAYLOAD，并且对手机管家进行BYPASS。

Hadoop Yan RPC unauthorized RCE

evtx-hunter helps to quickly spot interesting security-related activity in Windows Event Viewer (EVTX) files.

It is a very simple XSS simulator based on flask, python.

An OSINT tool that searches for devices directly connected to the internet (IoT) with a user specified query. It returns results for Webcams, Traffic lights, Refridgerators, Smart TVs etc.

CVE-2021-40346 integer overflow enables http smuggling

a cool, easily usable and customisable subdomains scanner

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements1

Sources

Footnotes

Owner

Duarte Duarte

Threat research and reporting from IronNet's Threat Research Teams

SecurAID securely connects aid organizations directly with individuals in dangerous situations to allow them to discreetly and effectively get the assistance they need.

Bug Alert: a service for alerting security and IT professionals of high-impact and 0day vulnerabilities

Installation of hacking tools

A collection of over 5.1 million sub-domains and assets belonging to public bug bounty programs, compiled into a repo, for performing bulk operations.

EMBArk - The firmware security scanning environment

JumpServer远程代码执行漏洞检测利用脚本

Detection And Breaking With Python

Um keylogger que se disfarça de um app que tira print da tela.

Simple and easy framework for phishing 🎣

AmiEviL - This program uses the Virus Total API to determine if your suspicious file is malicious or not

🔍 IRIS: An open-source intelligence framework

Multi-Process Vulnerability Tool

对安卓APP注入MSF PAYLOAD，并且对手机管家进行BYPASS。

Hadoop Yan RPC unauthorized RCE

evtx-hunter helps to quickly spot interesting security-related activity in Windows Event Viewer (EVTX) files.

It is a very simple XSS simulator based on flask, python.

An OSINT tool that searches for devices directly connected to the internet (IoT) with a user specified query. It returns results for Webcams, Traffic lights, Refridgerators, Smart TVs etc.

CVE-2021-40346 integer overflow enables http smuggling

a cool, easily usable and customisable subdomains scanner

Vulnerable app requirements¹