CVE-2022-22965 - CVE-2010-1622 redux

Last update: Aug 25, 2022

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

$ docker rm -f rce; docker build -t rce:latest . && docker run -d -p 8080:8080 --name rce rce:latest && sleep 5 && python poc.py

Output example

rce
sha256:f626a2190dc0790c610afd4f12a4b2482b6a726d671fdac1432275de89c07cd6
1a048e5725f754d331de9491d0750c4c7a163472dea1fd1554edccfd00d7f6e5
deploy <Response [200]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [500]>
webshell http://localhost:8080/tomcatwar.jsp?cmd=whoami
root

Identification with Semgrep

$ semgrep --config=semgrep-rule.yml .

Semgrep rule and test cases

Output example

Findings:

  src/main/java/com/example/demo/controller/IndexController.java
     cve-2022-22965
        Semgrep found a match


         14┆ @RequestMapping("/index")
         15┆ public void index(EvalBean evalBean) {
         16┆
         17┆ }

Ran 1 rule on 3 files: 1 finding.

Vulnerable app requirements¹

JDK 9 or above
Standalone Tomcat (no Embedded Tomcat) with WAR deployment
Any Spring version before 5.3.18 / 5.2.20 (Spring Boot before 2.5.12 / 2.6.6)
No blocklist on WebDataBinder / InitBinder
Parameter bind with POJOs directly (no @RequestBody, @RequestQuery, etc.)
Writeable file system (e.g webapps/ROOT)

Sources

Assuming exploits similar to the known PoCs. There might be other gadgets... ↩

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements¹

Sources

Owner

Duarte Duarte

Search Shodan for Minecraft server IPs to grief

Log4j minecraft with python

Crypto Meta Extractor

this keylogger is only for pc not for android but it will only work on those pc who have python installed it is made for all linux,windows and macos

The Decompressoin tool for Vxworks MINIFS

Something I built to test for Log4J vulnerabilities on customer networks.

Cam-Hacker: Ip Cameras hack with python

ProxyLogon(CVE-2021-26855+CVE-2021-27065) Exchange Server RCE(SSRF->GetWebShell)

Nmap automated port scanner written in Python

LinOTP - the open source solution for two factor authentication

A tool for making python source difficult to read.

🍉一款基于Python-Django的多功能Web安全渗透测试工具，包含漏洞扫描，端口扫描，指纹识别，目录扫描，旁站扫描，域名扫描等功能。

Mass Shortlink Bypass Merupakan Tools Yang Akan Bypass Shortlink Ke Tujuan Asli, Dibuat Dengan Python 3

Password-Manager GUI

HTTP security headers for Flask

FIVE, Vulnerability Scanner And Mass Exploiter, made for pentesting.

Python implementation for PrintNightmare (CVE-2021-1675 / CVE-2021-34527) using standard Impacket.

Program that mathematically generates and validates CPF numbers

Cryptick is a stock ticker for cryptocurrency tokens, and a physical NFT.

👑 Discovery Header DoD Bug-Bounty

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements1

Sources

Footnotes

Owner

Duarte Duarte

Search Shodan for Minecraft server IPs to grief

Log4j minecraft with python

Crypto Meta Extractor

this keylogger is only for pc not for android but it will only work on those pc who have python installed it is made for all linux,windows and macos

The Decompressoin tool for Vxworks MINIFS

Something I built to test for Log4J vulnerabilities on customer networks.

Cam-Hacker: Ip Cameras hack with python

ProxyLogon(CVE-2021-26855+CVE-2021-27065) Exchange Server RCE(SSRF->GetWebShell)

Nmap automated port scanner written in Python

LinOTP - the open source solution for two factor authentication

A tool for making python source difficult to read.

🍉一款基于Python-Django的多功能Web安全渗透测试工具，包含漏洞扫描，端口扫描，指纹识别，目录扫描，旁站扫描，域名扫描等功能。

Mass Shortlink Bypass Merupakan Tools Yang Akan Bypass Shortlink Ke Tujuan Asli, Dibuat Dengan Python 3

Password-Manager GUI

HTTP security headers for Flask

FIVE, Vulnerability Scanner And Mass Exploiter, made for pentesting.

Python implementation for PrintNightmare (CVE-2021-1675 / CVE-2021-34527) using standard Impacket.

Program that mathematically generates and validates CPF numbers

Cryptick is a stock ticker for cryptocurrency tokens, and a physical NFT.

👑 Discovery Header DoD Bug-Bounty

Vulnerable app requirements¹