关联漏洞
标题：
Spring Framework 代码注入漏洞
(CVE-2022-22965)
描述：Spring Framework是美国Spring团队的一套开源的Java、JavaEE应用程序框架。该框架可帮助开发人员构建高质量的应用。 Spring Framework 存在代码注入漏洞，该漏洞源于 JDK 9+ 上的数据绑定的 RCE。以下产品和版本受到影响：5.3.0 至 5.3.17、5.2.0 至 5.2.19、较旧的和不受支持的版本也会受到影响。
描述
Exploit a vulnerable Spring application with the Spring4Shell (CVE-2022-22965) Vulnerability.
介绍
# Spring4Shell Exploit POC
Exploit a Spring Application vulnerable to the Spring4Shell vulnerability. Read more about Spring4shell on our [blog](https://fourcore.io/blogs/spring4shell-zero-day-rce-spring-framework).
## Usage
Requirements: [Docker](https://docs.docker.com/engine/install/) and [docker-compose](https://docs.docker.com/compose/install/)
```
$ ./exploit.sh
```
[](https://asciinema.org/a/INYFtvNtAahfzJpJVAgTTI9EW)
## Vulnerable Spring Application
The vulnerable Spring application contains a GET and POST request handler for `/helloworld/greeting`. The `exploit.sh` script starts the app container running Tomcat 9.0 with the application packaged as a WAR and uses `curl` to write a webshell to `http://localhost:8080/shell.jsp`. The shell is used to grab the flag present at `/flag` inside the container's filesystem.
## CVE-2022-22965
The **CVE-2022-22965** with a **CVSS** score of **9.8** has been to the vulnerability in Spring Core allowing Remote Code Execution. The exploit is easy to achieve and hence the high CVSS score, pre-requisites for the exploit are:
- JDK version 9+
- Application built on Spring Or derived frameworks
- Running Tomcat with WAR deployment
## Resources
- [Spring Blog Early Announcement](https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement)
- [Lunasec blog](https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities/)
- [English translation of chinese researcher's original report](https://github.com/tweedge/springcore-0day-en)
## Credits
Based on the exploit and application by [reznok](https://github.com/reznok/Spring4Shell-POC).
文件快照
[4.0K] /data/pocs/81b4cd035d9366a0e56f8ef7a9ed3206037f8d20
├── [4.0K] app
│ ├── [1.6K] pom.xml
│ └── [4.0K] src
│ └── [4.0K] main
│ ├── [4.0K] java
│ │ └── [4.0K] com
│ │ └── [4.0K] foco
│ │ └── [4.0K] helloworld
│ │ ├── [ 315] Greeting.java
│ │ ├── [ 652] HelloController.java
│ │ └── [ 438] HelloworldApplication.java
│ └── [4.0K] resources
│ ├── [ 1] application.properties
│ └── [4.0K] templates
│ └── [ 182] hello.html
├── [ 116] docker-compose.yml
├── [ 200] Dockerfile
├── [1.9K] exploit.sh
├── [ 41] flag
├── [1.0K] LICENSE.md
└── [1.6K] README.md
9 directories, 12 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。