CVE-2022-22978-demo

CVE-2022-22978 vulnerability demo code

Exploitation Conditions

Although rated as high severity, the exploitation conditions are quite stringent. Personally, I find this vulnerability rather underwhelming.

1. First, spring-security must be within the affected scope.
2. Second, it requires the use of spring-security's regex matcher regexMatchers or directly using RegexRequestMatcher, and must employ . to match paths, for example:
   • regexMatcher("/api/.*") // allow all subpaths under /api
   • regexMatcher("/files/.*\\.jpg") // match all file requests ending with .jpg
   • regexMatcher("/user/.*/profile") // allow profile paths for any username under /user
3. In practice, such scenarios are rare. For example, with regexMatcher("/api/.*"), there must also be a controller annotated with @RequestMapping("/api/*") to handle all requests under /api. Otherwise, even if %0a%0d is used to bypass spring-security's path matching rules, a 404 error will be returned.

Exploitation Demo

Normal access to any path redirects to the default login page provided by spring-security.

Visit: http://127.0.0.1:8080/admin/admin%0a, successfully bypasses login.

Visit: http://127.0.0.1:8080/hello%0a Bypasses security checks that require login for all paths, but because there is no controller annotated with @RequestMapping("/hello/*"), mapping fails, resulting in a 404 error.