关联漏洞
标题：Spring Framework 代码注入漏洞 (CVE-2022-22965)描述：Spring Framework是美国Spring团队的一套开源的Java、JavaEE应用程序框架。该框架可帮助开发人员构建高质量的应用。 Spring Framework 存在代码注入漏洞，该漏洞源于 JDK 9+ 上的数据绑定的 RCE。以下产品和版本受到影响：5.3.0 至 5.3.17、5.2.0 至 5.2.19、较旧的和不受支持的版本也会受到影响。
描述
CVE-2022-22965 proof of concept for CS4239 report
介绍
# CS4239-Spring4Shell-POC
Proof of concept for CVE-2022-22965 (Spring4Shell) for CS4239 G410 report. Adapted from [this PoC](https://github.com/lunasec-io/Spring4Shell-POC) to demonstrate unpatched & patched behavior.
## Running the demo
There are 2 example programs (dockerized) in this repository with identical source code. One uses a vulnerable version of Spring Boot while the other uses a patched version. Tomcat also released a patch for this vulnerability, but the same vulnerable version of Tomcat is used for this demo to isolate the effects of the Spring patch.
To run demo apps:
```sh
docker compose build
docker compose up
```
- vulnerable:
- [localhost:8080/helloworld/greeting](http://localhost:8080/helloworld/greeting)
- tomcat 9.0.56 (vulnerable), spring boot 2.6.3 (depends on vulnerable spring framework 5.3.15)
- patched:
- [localhost:8081/helloworld/greeting](http://localhost:8081/helloworld/greeting)
- tomcat 9.0.56 (vulnerable), spring boot 2.6.6 (depends on patched spring framework 5.3.18)
To run exploit:
```sh
# vulnerable
python exploit.py --url "http://localhost:8080/helloworld/greeting"
# patched
python exploit.py --url "http://localhost:8081/helloworld/greeting"
```
If exploit works, a new page that allows us to run commands will be present. Example of running `id`:
```txt
http://localhost:8080/shell.jsp?cmd=id
```
Exploit does not work for patched version - `shell.jsp` is not injected.
文件快照
[4.0K] /data/pocs/c364540655abb6f34e7ed883964d1e9b71d37376
├── [ 421] docker-compose.yml
├── [ 311] Dockerfile
├── [4.0K] exploit.py
├── [1.7K] patched.pom.xml
├── [1.4K] README.md
├── [4.0K] src
│ ├── [4.0K] main
│ │ ├── [4.0K] java
│ │ │ └── [4.0K] com
│ │ │ └── [4.0K] reznok
│ │ │ └── [4.0K] helloworld
│ │ │ ├── [ 317] Greeting.java
│ │ │ ├── [ 654] HelloController.java
│ │ │ └── [ 440] HelloworldApplication.java
│ │ └── [4.0K] resources
│ │ ├── [ 1] application.properties
│ │ └── [4.0K] templates
│ │ └── [ 185] hello.html
│ └── [4.0K] test
│ └── [4.0K] java
│ └── [4.0K] com
│ └── [4.0K] reznok
│ └── [4.0K] helloworld
│ └── [ 217] HelloworldApplicationTests.java
└── [1.8K] vuln.pom.xml
14 directories, 12 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。