CVE-2022-21449 PoC — Oracle Java SE 输入验证错误漏洞

Source

Associated Vulnerability

Description

repo showcasing generating "psychic signatures for java" implemented in a nodejs environment 😅

Readme

# CVE-2022-21449
repo showcasing generation of a base64 signature for applications that are vulnerable to "psychic signatures in java", implemented in a nodejs environment 😅

Before running make sure to install the modified fork of elliptic from https://github.com/davwwwx/elliptic
```BASH
$ npm install
```

Generate the signature
```BASH
$ node index.js
```

![PoC](/run.png)


Get an example vulnerable application from DataDog/security-labs-pocs - [https://github.com/DataDog/security-labs-pocs/tree/main/proof-of-concept-exploits/jwt-null-signature-vulnerable-app](https://github.com/DataDog/security-labs-pocs/tree/main/proof-of-concept-exploits/jwt-null-signature-vulnerable-app)

File Snapshot

 [4.0K]  /data/pocs/f60551ca8fa71915bfbab7592bbb0e7ad3667af6
├── [ 442]  index.js
├── [ 573]  package.json
├── [5.3K]  package-lock.json
├── [ 690]  README.md
└── [ 15K]  run.png

0 directories, 5 files

Remarks