POC详情: d7d25e6e250693bed73b5aa76d1106f8d19ac231

来源
关联漏洞
标题: Spring Framework 代码注入漏洞 (CVE-2022-22965)
描述:Spring Framework是美国Spring团队的一套开源的Java、JavaEE应用程序框架。该框架可帮助开发人员构建高质量的应用。 Spring Framework 存在代码注入漏洞,该漏洞源于 JDK 9+ 上的数据绑定的 RCE。以下产品和版本受到影响:5.3.0 至 5.3.17、5.2.0 至 5.2.19、较旧的和不受支持的版本也会受到影响。
介绍
# CVE-2022-22965 PoC - Payara Arbitrary File Download

Minimal example of how to reproduce CVE-2022-22965 Spring vulnerability in Payara/Glassfish.

Alternative payload for Payara/Glassfish that allows the malicious user to set an arbitrary web root, leading to arbitrary file download. 

## Run using docker compose

1. Build the application using Docker compose
    ```shell
    docker-compose up --build
    ```
2. To test the app browse to [http://localhost:8080/handling-form-submission-complete/greeting](http://localhost:8080/handling-form-submission-complete/greeting)
3. Run the exploit
    ```shell
    ./exploits/run.sh
    ```
## Conditions

The exploit requires Java 9 or above because `module` property was added in Java 9.


文件快照
 [4.0K]  /data/pocs/d7d25e6e250693bed73b5aa76d1106f8d19ac231
├── [ 505]  build.gradle
├── [ 163]  docker-compose.yml
├── [ 339]  Dockerfile
├── [4.0K]  exploits
│   └── [ 287]  run.sh
├── [4.0K]  gradle
│   └── [4.0K]  wrapper
│       ├── [ 58K]  gradle-wrapper.jar
│       └── [ 200]  gradle-wrapper.properties
├── [5.6K]  gradlew
├── [2.7K]  gradlew.bat
├── [9.7K]  mvnw
├── [6.2K]  mvnw.cmd
├── [1.7K]  pom.xml
├── [ 740]  README.md
├── [  46]  settings.gradle
└── [4.0K]  src
    ├── [4.0K]  main
    │   ├── [4.0K]  java
    │   │   └── [4.0K]  com
    │   │       └── [4.0K]  example
    │   │           └── [4.0K]  handlingformsubmission
    │   │               ├── [ 951]  GreetingController.java
    │   │               ├── [ 330]  Greeting.java
    │   │               └── [2.1K]  HandlingFormSubmissionApplication.java
    │   └── [4.0K]  resources
    │       └── [4.0K]  templates
    │           ├── [ 560]  greeting.html
    │           └── [ 400]  result.html
    └── [4.0K]  test
        └── [4.0K]  java
            └── [4.0K]  com
                └── [4.0K]  example
                    └── [4.0K]  handlingformsubmission
                        └── [1.9K]  HandlingFormSubmissionApplicationTest.java

16 directories, 19 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问,请发送邮箱到 f.jinxu#gmail.com 索取本地快照(把 # 换成 @)。
    3. 神龙已为您对POC代码进行快照,为了长期维护,请考虑为本地POC付费,感谢您的支持。