CVE-2022-45688 PoC — Hutool 缓冲区错误漏洞

Source

Associated Vulnerability

Description

simple application with a CVE-2022-45688 vulnerability

Readme

## json.org CVE-2022-45688 true positive

The project illustrates [CVE-2022-45688](https://nvd.nist.gov/vuln/detail/CVE-2022-45688)  in [json.org](https://mvnrepository.com/artifact/org.json/json/20220924) -- there is a simple application
`XML2JSONConverter` to read XML from input, convert it to JSON and 
pretty-print it to the console. 

Using malicious input, the application crashes with a stackoverflow. 

The test case `CVE202245688Test` illustrates this behaviour, it 
can be executed by running `mvn test`.

### Running Software Composition Analyses

There are several sh scripts to run different analyses, result resports can be found in `scan-results`.

### Generating the SBOM

The `pom.xml` has a plugin to generate a [SBOM](https://www.cisa.gov/sbom) in [CycloneDX](https://cyclonedx.org/) format. 
To do this, run `mvn cyclonedx:makePackageBom`, the SBOM can be found in 
`target/` in `json` and `xml` format.

File Snapshot

 [4.0K]  /data/pocs/5b8521ccf9fa2d5256788f7b94e77321280ea565
├── [ 11K]  LICENSE
├── [2.7K]  pom.xml
├── [ 926]  README.md
├── [ 452]  run-owasp.sh
├── [ 261]  run-snyk.sh
├── [4.0K]  scan-results
│   ├── [4.0K]  dependency-check
│   │   └── [ 13K]  dependency-check-report.json
│   └── [4.0K]  snyk
│       └── [ 11K]  snyk-report.json
└── [4.0K]  src
    ├── [4.0K]  main
    │   └── [4.0K]  java
    │       └── [4.0K]  scabench
    │           └── [ 390]  XML2JSONConverter.java
    └── [4.0K]  test
        └── [4.0K]  java
            └── [4.0K]  scabench
                └── [ 473]  CVE202245688Test.java

10 directories, 9 files

Remarks