关联漏洞
标题：
Spring Framework 代码注入漏洞
(CVE-2022-22965)
描述：Spring Framework是美国Spring团队的一套开源的Java、JavaEE应用程序框架。该框架可帮助开发人员构建高质量的应用。 Spring Framework 存在代码注入漏洞，该漏洞源于 JDK 9+ 上的数据绑定的 RCE。以下产品和版本受到影响：5.3.0 至 5.3.17、5.2.0 至 5.2.19、较旧的和不受支持的版本也会受到影响。
描述
A Safer PoC for CVE-2022-22965 (Spring4Shell)
介绍
# Safer_PoC_CVE-2022-22965
A Safer PoC for CVE-2022-22965 (Spring4Shell)
## Functionality
- Creates a file called `CVE_2022-22965_exploited.txt` in the tomcat directory 'webapps/ROOT'
- Option user argument to change the output directory
- Exploit validation is performed by requesting the output .txt file, depending on your tomcat configuration this may require manual review.
- Additional verification added to check the content of the returned document; some web servers return an error page with HTTP status 200
## Usage
```
usage: Safer_PoC_CVE-2022-22965.py [-h] --url URL [--dir DIR]
CVE-2022-22965 Spring-Core remote code execution POC
optional arguments:
-h, --help show this help message and exit
--url URL target url
--dir DIR directory to write the result (default is "webapps")
```
Example: `python3 Safer_PoC_CVE-2022-22965.py --url http://localhost:8080/handling-form-submission-complete/greeting --dir "webapps/handling-form-submission-complete"`
## Output File
File Name: `CVE_2022_22965_exploited.txt`
File Contents: `Warning, CVE_2022_22965 was sucessfully exploited on this device. reference: https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement`
文件快照
[4.0K] /data/pocs/80bbc1f544cb99087ece1cdf459f1168b1c48067
├── [1.2K] README.md
└── [2.7K] Safer_PoC_CVE-2022-22965.py
0 directories, 2 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。