CVE-2022-22536 PoC — SAP多个产品环境问题漏洞

Source

https://github.com/abrewer251/CVE-2022-22536_SAP_Request_Smuggling_Scanner

Associated Vulnerability

Title:SAP多个产品环境问题漏洞 (CVE-2022-22536)
Description:SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.

Description

Fast, socket-level scanner for detecting CVE-2022-22536 in SAP ICM or Web Dispatcher instances. Performs request smuggling tests with a crafted MPI-desync payload. Supports batch scanning IP:PORT targets via plain text files.

Readme

# CVE-2022-22536 SAP Rquest Smuggling Scanner

This is a fast, socket-level batch scanner for **CVE-2022-22536**, a critical request smuggling vulnerability in **SAP Internet Communication Manager (ICM)** and **SAP Web Dispatcher**. It tests multiple hosts in parallel for protocol desynchronization behavior.

> CVE-2022-22536 is rated **CVSS 10.0** and is known to be exploited in the wild (CISA KEV list).  
> This tool helps identify potentially vulnerable SAP systems exposed over HTTP or HTTPS.

---

## 🚀 Features

- Supports scanning **IP[:PORT]** lists from a file
- Optional **SSL/TLS** and certificate validation
- **Parallel scanning** via multithreading
- CSV output of results
- No external dependencies except [`tqdm`] for progress bar

---

## 📦 Requirements

- Python 3.6+
- [`tqdm`](https://pypi.org/project/tqdm/)

Install:

```bash
pip install tqdm

File Snapshot


 [4.0K]  /data/pocs/4fb5fba074f738f2fe7c8f2e547744e29f3f44eb
├── [1.0K]  LICENSE
├── [ 875]  README.md
└── [5.5K]  scanner.py

1 directory, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!