cve-2022-22965是什么，一个至少超越我此刻理解力的漏洞

最新推荐文章于 2024-09-17 22:57:08 发布

叶常落

最新推荐文章于 2024-09-17 22:57:08 发布

阅读量3.2k

点赞数

分类专栏： java 文章标签： cve

本文链接：https://blog.csdn.net/lineuman/article/details/123883479

版权

java 专栏收录该内容

16 篇文章 0 订阅

订阅专栏

如果说我上一篇文章中介绍的spring-cloud-function的rce还在我的理解范围之内，那么cve-2022-22965已经超出我的理解范围了。也许未来的某一天我有兴趣研究它，但是现在我完全不了解它。

在这里插入图片描述

只能摘抄一下

CVE-2022-22965: Spring Framework RCE via Data Binding on JDK 9+

Severity
High

Vendor
Spring by VMware

Description
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

These are the prerequisites for the exploit:

JDK 9 or higher
Apache Tomcat as the Servlet container
Packaged as WAR
spring-webmvc or spring-webflux dependency
Affected VMware Products and Versions
Severity is high unless otherwise noted.

Spring Framework
5.3.0 to 5.3.17
5.2.0 to 5.2.19
Older, unsupported versions are also affected
Mitigation

This vulnerability was responsibly reported to VMware by codeplutos, meizjm3i of AntGroup FG Security Lab. A secondary report was also received from Praetorian.

References
https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement
History
2022-03-31: Initial vulnerability report published.