CVE-2022-22965 - CVE-2010-1622 redux

Last update: Aug 25, 2022

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

$ docker rm -f rce; docker build -t rce:latest . && docker run -d -p 8080:8080 --name rce rce:latest && sleep 5 && python poc.py

Output example

rce
sha256:f626a2190dc0790c610afd4f12a4b2482b6a726d671fdac1432275de89c07cd6
1a048e5725f754d331de9491d0750c4c7a163472dea1fd1554edccfd00d7f6e5
deploy <Response [200]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [500]>
webshell http://localhost:8080/tomcatwar.jsp?cmd=whoami
root

Identification with Semgrep

$ semgrep --config=semgrep-rule.yml .

Semgrep rule and test cases

Output example

Findings:

  src/main/java/com/example/demo/controller/IndexController.java
     cve-2022-22965
        Semgrep found a match


         14┆ @RequestMapping("/index")
         15┆ public void index(EvalBean evalBean) {
         16┆
         17┆ }

Ran 1 rule on 3 files: 1 finding.

Vulnerable app requirements¹

JDK 9 or above
Standalone Tomcat (no Embedded Tomcat) with WAR deployment
Any Spring version before 5.3.18 / 5.2.20 (Spring Boot before 2.5.12 / 2.6.6)
No blocklist on WebDataBinder / InitBinder
Parameter bind with POJOs directly (no @RequestBody, @RequestQuery, etc.)
Writeable file system (e.g webapps/ROOT)

Sources

Assuming exploits similar to the known PoCs. There might be other gadgets... ↩

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements¹

Sources

Owner

Duarte Duarte

Grafana-POC(CVE-2021-43798)

MVT is a forensic tool to look for signs of infection in smartphone devices

All in One CRACKER911181's Tool. This Tool For Hacking and Pentesting.🎭

Gitlab RCE - Remote Code Execution

BurpSuite Extension: Log4j2 RCE Scanner

This program is a WiFi cracker, you can test many passwords for a desired wifi to find the wifi password!

Js File Scanner This is Js File Scanner

CVE-2021-26855: PoC (Not a HoneyPoC for once!)

Buff A simple BOF library I wrote under an hour to help me automate with BOF attack

A brute force tool for password-protected zip file

A python tool capable of creating HUGE wordlists. Has the ability to add custom words for concatenation in any way you see fit.

A tool that detects the expensive Carbon Black watchlists.

DomainMonitor is a web project that has a RESTful API to get a domain's subdomains and whois data.

In this program, I generate the strong password from existing password without class using python. The special thing in this program is that is generate very strong password from our existing password. It replaces some elements from password and put another elements in it.

A Fast Broken Link Hijacker Tool written in Python

SubFind - Subdomain Finder Tools

Complet and easy to run Port Scanner with Python

A Superfast SMS & Call bomber for Linux And Termux !

log4j2 dos exploit,CVE-2021-45105 exploit,Denial of Service poc

Kunyu, more efficient corporate asset collection

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements1

Sources

Footnotes

Owner

Duarte Duarte

Grafana-POC(CVE-2021-43798)

MVT is a forensic tool to look for signs of infection in smartphone devices

All in One CRACKER911181's Tool. This Tool For Hacking and Pentesting.🎭

Gitlab RCE - Remote Code Execution

BurpSuite Extension: Log4j2 RCE Scanner

This program is a WiFi cracker, you can test many passwords for a desired wifi to find the wifi password!

Js File Scanner This is Js File Scanner

CVE-2021-26855: PoC (Not a HoneyPoC for once!)

Buff A simple BOF library I wrote under an hour to help me automate with BOF attack

A brute force tool for password-protected zip file

A python tool capable of creating HUGE wordlists. Has the ability to add custom words for concatenation in any way you see fit.

A tool that detects the expensive Carbon Black watchlists.

DomainMonitor is a web project that has a RESTful API to get a domain's subdomains and whois data.

In this program, I generate the strong password from existing password without class using python. The special thing in this program is that is generate very strong password from our existing password. It replaces some elements from password and put another elements in it.

A Fast Broken Link Hijacker Tool written in Python

SubFind - Subdomain Finder Tools

Complet and easy to run Port Scanner with Python

A Superfast SMS & Call bomber for Linux And Termux !

log4j2 dos exploit,CVE-2021-45105 exploit,Denial of Service poc

Kunyu, more efficient corporate asset collection

Vulnerable app requirements¹