关联漏洞
标题：
Oracle Java SE 输入验证错误漏洞
(CVE-2022-21449)
描述：Oracle Java SE是美国甲骨文（Oracle）公司的一款用于开发和部署桌面、服务器以及嵌入设备和实时环境中的Java应用程序。 Oracle Java SE 中存在输入验证错误漏洞，该漏洞允许未经身份验证的攻击者通过多种协议进行网络访问，从而破坏 Oracle Java SE、Oracle GraalVM 企业版。成功攻击此漏洞可能导致对关键数据或所有 Oracle Java SE、Oracle GraalVM 企业版可访问数据的未经授权的创建、删除或修改访问。
介绍
# CVE-2022-21449
### Overview
This tool allows to perform a quick scan of compiled code archives (.jar, .war etc) in order to check for vulnerability to CVE-2022-21449 by looking for the string indicating the use of ECDSA algorithm. The tool uses Python3 with no additional prerequisites.
##### Usage
```
python cve_2022_21449.py root-folder [-quiet] [-exclude folder1 folder2 ..]
```
or
```
python cve_2022_21449.py root-archive [-quiet] [-exclude folder1 folder2 ..]
```
The tool will scan `root_folder` recursively for `.jar` and `.war` files; in each located archive the tool examines the `.class` files for appearances of `"withECDSA"` string.
With `-quiet` flag, error messages (files not found/ archives failed to open/ password protected archives) are muted.
Folders appearing after `-exclude` (optional) are skipped.
##### Output example
<img src="img/screenshot.PNG" style="zoom:33%;" />
### Bash script
Alternatively, one could use the `cve_2022_21449.sh` Bash script, which is somewhat slower, and requires installing zipgrep tool.
Usage:
```
./cve_2022_21449.sh root-folder
```
文件快照
[4.0K] /data/pocs/3054c0e3dc0193e866e6bbcce19f49ce8a308644
├── [5.5K] cve_2022_21449.py
├── [ 366] cve_2022_21449.sh
├── [4.0K] img
│ └── [ 22K] screenshot.PNG
├── [ 11K] LICENSE
└── [1.1K] README.md
1 directory, 5 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。