CVE-2022-40146 PoC — Jar url should be blocked by DefaultScriptSecurity

Source

https://github.com/cckuailong/CVE-2022-40146_Exploit_Jar

Associated Vulnerability

Title: Jar url should be blocked by DefaultScriptSecurity (CVE-2022-40146)
Description:Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.

Readme

# Apache Batik SSRF to RCE Jar Exploit

## Component link

https://github.com/apache/xmlgraphics-batik

## Blog

https://www.zerodayinitiative.com/blog/2022/10/28/vulnerabilities-in-apache-batik-default-security-controls-ssrf-and-rce-through-remote-class-loading

## Usage 

- Modify the line 11 in src/main/java/com.poc.Poc.java to change the command.
- Run `mvn clean package`
- Exploit can be found in target/

Then you need to navigate to the [Poc/](Poc) to use this exploit jar.

### Poc contains:

- SSRF
- RCE via jar
- RCE via ecmascript

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →