CVE-2022-22965

CVE-2022-22965 EXP

General environment requirements:

1. Whether Spring framework is used; if not, the vulnerability does not exist
2. Whether Spring parameter binding is used; if not, the vulnerability does not exist
3. The JDK version used by the middleware; if the version is lower than 9, the vulnerability does not exist
4. Whether the middleware currently in use is Tomcat; if Tomcat is not used, it is not affected by this vulnerability for now
5. Whether Tomcat has AccessLog enabled; if not enabled, it is not affected by this vulnerability for now In the server.xml configuration file, the AccessLog-related configuration can be located by the keyword org.apache.catalina.valves.AccessLogValve.

Specific scenarios in the official advisory:

1. Packaged as a traditional WAR (compared to Spring Boot executable jar)
2. spring-webmvc or spring-webflux dependency
3. Spring Framework versions 5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and earlier versions

Exploit environment requirements: python3

Required Python packages: requests, argparse, urllib.parse