CVE-2022-22965

Spring Framework/CVE-2022-22965

Vulnerability ID: CVE-2022-22965/CNVD-2022-23942/QVD-2022-1691

Reproduce the vulnerability

docker pull vulfocus/spring-core-rce-2022-03-29
docker run -dit -p 8080:8080 vulfocus/spring-core-rce-2022-03-29

Vulnerability detection

POC

It is recommended to use POC to detect the target. Its advantage is to verify whether the vulnerability exists based on DNSLOG, and it will not modify the log configuration of tomcat

python3 cve-2022-22965-poc.py -url https://example.com/
python3 cve-2022-22965-poc.py -file file.txt

EXP

python3 cve-2022-22965.py -url https://example.com/
python3 cve-2022-22965.py -file file.txt

Exploit

POC

python3 cve-2022-22965-poc.py -url https://example.com/

EXP

python3 cve-2022-22965.py -url http://example.com/

Fuzz

POC

Add common routs on line 13

routs = ['env',]

EXP Fuzz

Add common path on line 12

path = ['root',]

• WARNING:*

• This EXP will write unsuccessful http requests together to a file.
• This EXP changes the tomcat configuration.

For safe learning only, do not use illegally

仅用安全学习，请勿非法使用