CVE-2022-22965 - CVE-2010-1622 redux

Last update: Aug 25, 2022

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

$ docker rm -f rce; docker build -t rce:latest . && docker run -d -p 8080:8080 --name rce rce:latest && sleep 5 && python poc.py

Output example

rce
sha256:f626a2190dc0790c610afd4f12a4b2482b6a726d671fdac1432275de89c07cd6
1a048e5725f754d331de9491d0750c4c7a163472dea1fd1554edccfd00d7f6e5
deploy <Response [200]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [404]>
webshell <Response [500]>
webshell http://localhost:8080/tomcatwar.jsp?cmd=whoami
root

Identification with Semgrep

$ semgrep --config=semgrep-rule.yml .

Semgrep rule and test cases

Output example

Findings:

  src/main/java/com/example/demo/controller/IndexController.java
     cve-2022-22965
        Semgrep found a match


         14┆ @RequestMapping("/index")
         15┆ public void index(EvalBean evalBean) {
         16┆
         17┆ }

Ran 1 rule on 3 files: 1 finding.

Vulnerable app requirements¹

JDK 9 or above
Standalone Tomcat (no Embedded Tomcat) with WAR deployment
Any Spring version before 5.3.18 / 5.2.20 (Spring Boot before 2.5.12 / 2.6.6)
No blocklist on WebDataBinder / InitBinder
Parameter bind with POJOs directly (no @RequestBody, @RequestQuery, etc.)
Writeable file system (e.g webapps/ROOT)

Sources

Assuming exploits similar to the known PoCs. There might be other gadgets... ↩

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements¹

Sources

Owner

Duarte Duarte

Exploit and Check Script for CVE 2022-1388

Malware for Discord, designed to steal passwords, tokens, and inject discord folders for long-term use.

A tool to crack a wifi password with a help of wordlist

wsvuls - website vulnerability scanner detect issues [ outdated server software and insecure HTTP headers.]

ADExplorerSnapshot.py is an AD Explorer snapshot ingestor for BloodHound.

CamRaptor is a tool that exploits several vulnerabilities in popular DVR cameras to obtain device credentials.

MITMSDR for INDIAN ARMY cybersecurity hackthon

Signatures and IoCs from public Volexity blog posts.

python driver for fingerprint machine (ZKTeco biometrics)

SSH Tool For OSINT and then Cracking.

This is the fuzzer I made to fuzz Preview on macOS and iOS like 8years back when I just started fuzzing things.

CVE-2021-40346 integer overflow enables http smuggling

LinOTP - the open source solution for two factor authentication

Vulnerability Scanner & Auto Exploiter You can use this tool to check the security by finding the vulnerability in your website or you can use this tool to Get Shells

PrivateRoom - Make your work private by building a system using arduino which instantly kills a program when someone enters your room/cabin

An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.

A simple python-function, to gain all wlan passwords from stored wlan-profiles on a computer.

Password Manager is a simple Python project which helps users in managing their passwords in a easier way

Gmail Accounts Hacking

Hubble is a modular, open-source security compliance framework. The project provides on-demand profile-based auditing, real-time security event notifications, alerting, and reporting. HubbleStack is a free and open source project made possible by Adobe. https://github.com/adobe

CVE-2022-22965 - CVE-2010-1622 redux

Related tags

Overview

CVE-2022-22965 - vulnerable app and PoC

Trial & error

Output example

Identification with Semgrep

Output example

Vulnerable app requirements1

Sources

Footnotes

Owner

Duarte Duarte

Exploit and Check Script for CVE 2022-1388

Malware for Discord, designed to steal passwords, tokens, and inject discord folders for long-term use.

A tool to crack a wifi password with a help of wordlist

wsvuls - website vulnerability scanner detect issues [ outdated server software and insecure HTTP headers.]

ADExplorerSnapshot.py is an AD Explorer snapshot ingestor for BloodHound.

CamRaptor is a tool that exploits several vulnerabilities in popular DVR cameras to obtain device credentials.

MITMSDR for INDIAN ARMY cybersecurity hackthon

Signatures and IoCs from public Volexity blog posts.

python driver for fingerprint machine (ZKTeco biometrics)

SSH Tool For OSINT and then Cracking.

This is the fuzzer I made to fuzz Preview on macOS and iOS like 8years back when I just started fuzzing things.

CVE-2021-40346 integer overflow enables http smuggling

LinOTP - the open source solution for two factor authentication

Vulnerability Scanner & Auto Exploiter You can use this tool to check the security by finding the vulnerability in your website or you can use this tool to Get Shells

PrivateRoom - Make your work private by building a system using arduino which instantly kills a program when someone enters your room/cabin

An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.

A simple python-function, to gain all wlan passwords from stored wlan-profiles on a computer.

Password Manager is a simple Python project which helps users in managing their passwords in a easier way

Gmail Accounts Hacking

Hubble is a modular, open-source security compliance framework. The project provides on-demand profile-based auditing, real-time security event notifications, alerting, and reporting. HubbleStack is a free and open source project made possible by Adobe. https://github.com/adobe

Vulnerable app requirements¹