CVE-2022-22965 - CVE-2010-1622 redux

Last update: Aug 25, 2022

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

$ docker rm -f rce; docker build -t rce:latest . && docker run -d -p 8080:8080 --name rce rce:latest && sleep 5 && python poc.py

Output example

rce
sha256:f626a2190dc0790c610afd4f12a4b2482b6a726d671fdac1432275de89c07cd6
1a048e5725f754d331de9491d0750c4c7a163472dea1fd1554edccfd00d7f6e5
deploy <Response [200]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [500]>
webshell http://localhost:8080/tomcatwar.jsp?cmd=whoami
root

Identification with Semgrep

$ semgrep --config=semgrep-rule.yml .

Semgrep rule and test cases

Output example

Findings:

  src/main/java/com/example/demo/controller/IndexController.java
     cve-2022-22965
        Semgrep found a match


         14┆ @RequestMapping("/index")
         15┆ public void index(EvalBean evalBean) {
         16┆
         17┆ }

Ran 1 rule on 3 files: 1 finding.

Vulnerable app requirements¹

JDK 9 or above
Standalone Tomcat (no Embedded Tomcat) with WAR deployment
Any Spring version before 5.3.18 / 5.2.20 (Spring Boot before 2.5.12 / 2.6.6)
No blocklist on WebDataBinder / InitBinder
Parameter bind with POJOs directly (no @RequestBody, @RequestQuery, etc.)
Writeable file system (e.g webapps/ROOT)

Sources

Assuming exploits similar to the known PoCs. There might be other gadgets... ↩

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements¹

Sources

Owner

Duarte Duarte

"Video Moment Retrieval from Text Queries via Single Frame Annotation" in SIGIR 2022.

Wordlist attacks on Bitwarden data.json files

orfipy is a tool written in python/cython to extract ORFs in an extremely and fast and flexible manner

Malware Configuration And Payload Extraction

GitGuardian Shield: protect your secrets with GitGuardian

Analyse a forensic target (such as a directory) to find and report files found and not found from CIRCL hashlookup public service

A high-performance DNS stub resolver for bulk lookups and reconnaissance (subdomain enumeration)

HTTP Protocol Stack Remote Code Execution Vulnerability CVE-2022-21907

信息收集自动化工具

Python sandbox runners for executing code in isolation aka snekbox.

Laravel RCE (CVE-2021-3129)

Python decompiler for Python 1.5-2.4 (for historical archive)

Proof of concept to check if hosts are vulnerable to CVE-2021-41773

A decompilation of the Nintendo Switch version of Captain Toad: Treasure Tracker

Password-Manager - This app can generate ,save , find and delete passwords.

Simple Dos-Attacker.

Scans for Log4j versions effected by CVE-2021-44228

NEW FACEBOOK CLONER WITH NEW PASSWORD, TERMUX FB CLONE, FB CLONING COMMAND. M

Repository for a project of the course EP2520 Building Networked Systems Security

A Python Bytecode Disassembler helping reverse engineers in dissecting Python binaries

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements1

Sources

Footnotes

Owner

Duarte Duarte

"Video Moment Retrieval from Text Queries via Single Frame Annotation" in SIGIR 2022.

Wordlist attacks on Bitwarden data.json files

orfipy is a tool written in python/cython to extract ORFs in an extremely and fast and flexible manner

Malware Configuration And Payload Extraction

GitGuardian Shield: protect your secrets with GitGuardian

Analyse a forensic target (such as a directory) to find and report files found and not found from CIRCL hashlookup public service

A high-performance DNS stub resolver for bulk lookups and reconnaissance (subdomain enumeration)

HTTP Protocol Stack Remote Code Execution Vulnerability CVE-2022-21907

信息收集自动化工具

Python sandbox runners for executing code in isolation aka snekbox.

Laravel RCE (CVE-2021-3129)

Python decompiler for Python 1.5-2.4 (for historical archive)

Proof of concept to check if hosts are vulnerable to CVE-2021-41773

A decompilation of the Nintendo Switch version of Captain Toad: Treasure Tracker

Password-Manager - This app can generate ,save , find and delete passwords.

Simple Dos-Attacker.

Scans for Log4j versions effected by CVE-2021-44228

NEW FACEBOOK CLONER WITH NEW PASSWORD, TERMUX FB CLONE, FB CLONING COMMAND. M

Repository for a project of the course EP2520 Building Networked Systems Security

A Python Bytecode Disassembler helping reverse engineers in dissecting Python binaries

Vulnerable app requirements¹