CVE-2022-22965 - CVE-2010-1622 redux

Last update: Aug 25, 2022

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

$ docker rm -f rce; docker build -t rce:latest . && docker run -d -p 8080:8080 --name rce rce:latest && sleep 5 && python poc.py

Output example

rce
sha256:f626a2190dc0790c610afd4f12a4b2482b6a726d671fdac1432275de89c07cd6
1a048e5725f754d331de9491d0750c4c7a163472dea1fd1554edccfd00d7f6e5
deploy <Response [200]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [500]>
webshell http://localhost:8080/tomcatwar.jsp?cmd=whoami
root

Identification with Semgrep

$ semgrep --config=semgrep-rule.yml .

Semgrep rule and test cases

Output example

Findings:

  src/main/java/com/example/demo/controller/IndexController.java
     cve-2022-22965
        Semgrep found a match


         14┆ @RequestMapping("/index")
         15┆ public void index(EvalBean evalBean) {
         16┆
         17┆ }

Ran 1 rule on 3 files: 1 finding.

Vulnerable app requirements¹

JDK 9 or above
Standalone Tomcat (no Embedded Tomcat) with WAR deployment
Any Spring version before 5.3.18 / 5.2.20 (Spring Boot before 2.5.12 / 2.6.6)
No blocklist on WebDataBinder / InitBinder
Parameter bind with POJOs directly (no @RequestBody, @RequestQuery, etc.)
Writeable file system (e.g webapps/ROOT)

Sources

Assuming exploits similar to the known PoCs. There might be other gadgets... ↩

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements¹

Sources

Owner

Duarte Duarte

Wonk is a tool for combining a set of AWS policy files into smaller compiled policy sets.

Bandit is a tool designed to find common security issues in Python code.

Brute force attack tool for Azure AD Autologon/Seamless SSO

Python script that sends CVE-2021-44228 log4j payload requests to url list

the metasploit script(POC) about CVE-2021-36260

GDID (Google Dorks for Information Disclosure)

A python tool capable of creating HUGE wordlists. Has the ability to add custom words for concatenation in any way you see fit.

Buffer Overflow para SLmail5.5 32 bits

Springboot directory scanning

You can crack any zip file and get the password.

Repository for a project of the course EP2520 Building Networked Systems Security

ONT Analysis Toolkit (OAT)

Sample exploits for Zephyr CVE-2021-3625

Scanner for Intranet

Something I built to test for Log4J vulnerabilities on customer networks.

HTTP security headers for Flask

Open Source Intelligence gathering tool aimed at reducing the time spent harvesting information from open sources.

Open-source jailbreaking tool for many iOS devices

Brute-forcing (or not!) deck builder for Pokemon Trading Card Game.

Pass2Pwn: a simple python3 tool created to assist penetration testers generate possible passwords for a targeted system based solely on the organization's name

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements1

Sources

Footnotes

Owner

Duarte Duarte

Wonk is a tool for combining a set of AWS policy files into smaller compiled policy sets.

Bandit is a tool designed to find common security issues in Python code.

Brute force attack tool for Azure AD Autologon/Seamless SSO

Python script that sends CVE-2021-44228 log4j payload requests to url list

the metasploit script(POC) about CVE-2021-36260

GDID (Google Dorks for Information Disclosure)

A python tool capable of creating HUGE wordlists. Has the ability to add custom words for concatenation in any way you see fit.

Buffer Overflow para SLmail5.5 32 bits

Springboot directory scanning

You can crack any zip file and get the password.

Repository for a project of the course EP2520 Building Networked Systems Security

ONT Analysis Toolkit (OAT)

Sample exploits for Zephyr CVE-2021-3625

Scanner for Intranet

Something I built to test for Log4J vulnerabilities on customer networks.

HTTP security headers for Flask

Open Source Intelligence gathering tool aimed at reducing the time spent harvesting information from open sources.

Open-source jailbreaking tool for many iOS devices

Brute-forcing (or not!) deck builder for Pokemon Trading Card Game.

Pass2Pwn: a simple python3 tool created to assist penetration testers generate possible passwords for a targeted system based solely on the organization's name

Vulnerable app requirements¹