关联漏洞
标题:
Spring Framework 代码注入漏洞
(CVE-2022-22965)
描述:Spring Framework是美国Spring团队的一套开源的Java、JavaEE应用程序框架。该框架可帮助开发人员构建高质量的应用。 Spring Framework 存在代码注入漏洞,该漏洞源于 JDK 9+ 上的数据绑定的 RCE。以下产品和版本受到影响:5.3.0 至 5.3.17、5.2.0 至 5.2.19、较旧的和不受支持的版本也会受到影响。
描述
Spring-0day/CVE-2022-22965
介绍
# CVE-2022-22965
[Spring Framework/CVE-2022-22965](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22965)
Vulnerability ID: CVE-2022-22965/CNVD-2022-23942/QVD-2022-1691
### Reproduce the vulnerability
```bash
docker pull vulfocus/spring-core-rce-2022-03-29
docker run -dit -p 8080:8080 vulfocus/spring-core-rce-2022-03-29
```

### Vulnerability detection
#### POC
It is recommended to use POC to detect the target. Its advantage is to verify whether the vulnerability exists based on [DNSLOG](https://dig.pm/), and it will not modify the log configuration of tomcat
```bash
python3 cve-2022-22965-poc.py -url https://example.com/
python3 cve-2022-22965-poc.py -file file.txt
```

#### EXP
```bash
python3 cve-2022-22965.py -url https://example.com/
python3 cve-2022-22965.py -file file.txt
```

### Exploit
#### POC
```bash
python3 cve-2022-22965-poc.py -url https://example.com/
```

#### EXP
```bash
python3 cve-2022-22965.py -url http://example.com/
```

#### Fuzz
##### POC
*Add common routs on line 13*
```python
routs = ['env',]
```
##### EXP Fuzz
*Add common path on line 12*
```python
path = ['root',]
````
* WARNING:*
- This EXP will write unsuccessful http requests together to a file.
- This EXP changes the tomcat configuration.

----
**For safe learning only, do not use illegally**
**仅用安全学习,请勿非法使用**
文件快照
[4.0K] /data/pocs/0d2f1bebadc4d6389475d3ffe578fb652b40701f
├── [4.4K] cve-2022-22965-poc.py
├── [3.2K] cve-2022-22965.py
├── [2.0K] README.md
└── [ 1] result.txt
0 directories, 4 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问,请发送邮箱到 f.jinxu#gmail.com 索取本地快照(把 # 换成 @)。
3. 神龙已为您对POC代码进行快照,为了长期维护,请考虑为本地POC付费,感谢您的支持。