CVE-2022-22970 PoC — Spring Framework 输入验证错误漏洞

Source

https://github.com/Performant-Labs/CVE-2022-22970

Associated Vulnerability

Title: Spring Framework 输入验证错误漏洞 (CVE-2022-22970)
Description:In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.

Readme

# Spring CVE-2022-22970

## Proof of Concept

This repo contains a Development Container environment and Spring application of the correct version specifically to explore this CVE.

### Setup Instructions
Clone the repo to your machine and use Docker and your favorite IDE.

OR

Use GitPod online with `https://gitpod.io/#<URL to this repo>`

OR

Use GitPod Desktop:

1. [Download GitPod Desktop](https://www.gitpod.io/gitpod-desktop/download) and install it.
1. Click Projects.
1. Click New Environment.
1. Provide the URL of this repo.

Within the development environment you've chosen above:
1. Run the app:
<pre>
cd spring-cve-harness
mvn spring-boot:run
</pre>
2. Perform the exploit.

Don't forget to commit your changes back to this repo.

## Useful URLs
Development Containers Project Page
- https://containers.dev

Development Containers Images
- https://github.com/devcontainers/images

Developing inside a container
- https://code.visualstudio.com/docs/devcontainers/containers

Container Guides
- https://containers.dev/guides

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →