CVE-2022-21449 PoC — Oracle Java SE 输入验证错误漏洞

Description

repo showcasing generating "psychic signatures for java" implemented in a nodejs environment 😅

介绍

# CVE-2022-21449
repo showcasing generation of a base64 signature for applications that are vulnerable to "psychic signatures in java", implemented in a nodejs environment 😅

Before running make sure to install the modified fork of elliptic from https://github.com/davwwwx/elliptic
```BASH
$ npm install
```

Generate the signature
```BASH
$ node index.js
```

![PoC](/run.png)


Get an example vulnerable application from DataDog/security-labs-pocs - [https://github.com/DataDog/security-labs-pocs/tree/main/proof-of-concept-exploits/jwt-null-signature-vulnerable-app](https://github.com/DataDog/security-labs-pocs/tree/main/proof-of-concept-exploits/jwt-null-signature-vulnerable-app)

文件快照

备注