kirill89 / cve-2022-22965-poc

Hi, I'm Kirill 👋

Information Security Researcher · Software Engineer · Open Source Software Contributor

---

Blogs

• 2022-05-24 Snyk finds 200+ malicious npm packages, including Cobalt Strike dependency confusion attacks
• 2022-04-04 Exploring 3 types of directory traversal vulnerabilities in C/C++
• 2022-01-10 Exploiting URL parser confusion
• 2021-06-02 Mitigating and remediating intent-based Android security vulnerabilities
• 2021-05-27 Hunting intent-based Android security vulnerabilities with Snyk Code
• 2021-05-18 Exploring intent-based Android security vulnerabilities on Google Play
• 2021-05-06 Deep dive into Visual Studio Code extension security vulnerabilities
• 2020-10-15 SourMint Malicious SDK Research write up
• 2020-03-26 Exploring the minimist prototype pollution security vulnerability
• 2016-12-07 Remote (dev)tools своими руками – интервью с Романом Дворновым (Авито)
• 2016-10-21 Дробим монолит: Рефакторинг архитектуры Web-приложений
• 2016-08-16 Запускаем Node.js на JVM
• 2012-02-06 MSP430, учимся программировать и отлаживать железо (часть 3)
• 2012-02-01 MSP430, учимся программировать и отлаживать железо (часть 2)
• 2012-01-09 MSP430, учимся программировать и отлаживать железо
• 2011-06-20 Amazon Route 53 и бесперебойная работа сайта

---

Talks

• 2021-12-15 Log4Shell: What You Need to Know About the Log4j Vulnerability
• 2021-11-23 WeAreDevelopers JavaScript Congress 2021: Vulnerable VS Code extensions are now at your front door
• 2021-11-16 INTENT Summit: 1-click to infiltrate your org via vulnerable VS Code extensions
• 2021-11-03 Ekoparty 2021: 1-click to infiltrate your organization via vulnerable VS Code extensions
• 2021-06-02 I can use VS Code to hack into your development environment
• 2020-10-15 Security BSides Dublin: The Case Of Malicious Advertisement SDK Affecting Thousands Of Mobile Apps
• 2015-10-10 Учим linux вместе: Настройка окружения для написания модулей
• 2015-10-10 Учим linux вместе: Взаимодействие с proc fs
• 2015-09-19 Учим linux вместе: Как происходит загрузка ОС

---

Vulnerabilities

1. Open Redirect in Gophish
2. Path Traversal in Pistache CVE-2022-26068, C/C++
3. Path Traversal in Webcc CVE-2022-25298, C/C++
4. Arbitrary File Write in Drogon CVE-2022-25297, C/C++
5. Arbitrary File Write in Mongoose CVE-2022-25299, C/C++
6. Content Injection in Crow CVE-2021-23824, C/C++
7. Path Traversal in Crow CVE-2021-23514, C/C++
8. Arbitrary File Write in Iris Web Framework CVE-2021-23772, Go
9. Open Redirect in Clearance CVE-2021-23435, Ruby
10. DOM-based XSS in Video.js CVE-2021-23414, JavaScript
11. Open Redirect in Gitpod Go
12. Prototype Pollution in nedb CVE-2021-23395, JavaScript
13. Prototype Pollution in yargs-parser CVE-2020-7608, JavaScript
14. Prototype Pollution in minimist CVE-2020-7598, JavaScript
15. Denial of Service in ecstatic CVE-2019-10775, JavaScript
16. Command Injection in php-shellcommand CVE-2019-10774, PHP
17. SQL Injection in Medoo CVE-2019-10762, PHP
18. SQL Injection in Pixie Query Builder CVE-2019-10766, PHP
19. Prototype Pollution in AngularJS CVE-2019-10768, JavaScript
20. SQL Injection in knex.js CVE-2019-10757, JavaScript
21. SQL Injection in sequelize CVE-2019-10748, JavaScript
22. Prototype Pollution in lodash and lodash.merge CVE-2019-10744, JavaScript

---

cve-2022-22965-poc's Issues

NullValueInNestedPathException when following steps in README

When I follow the steps outlined in the README I run into an exception when issuing the call to /greeting and the following stacktrace is emitted:

2022-04-04 14:20:11.624 ERROR 1 --- [nio-8080-exec-3] o.s.b.w.servlet.support.ErrorPageFilter  : Forwarding to error page from request [/greeting] due to exception [Invalid property 'class.module.classLoader.resources' of bean class [java.lang.Module]: Could not instantiate property type [org.apache.catalina.WebResourceRoot] to auto-grow nested property path; nested exception is java.lang.NoSuchMethodException: org.apache.catalina.WebResourceRoot.<init>()]

org.springframework.beans.NullValueInNestedPathException: Invalid property 'class.module.classLoader.resources' of bean class [java.lang.Module]: Could not instantiate property type [org.apache.catalina.WebResourceRoot] to auto-grow nested property path; nested exception is java.lang.NoSuchMethodException: org.apache.catalina.WebResourceRoot.<init>()
	at org.springframework.beans.AbstractNestablePropertyAccessor.newValue(AbstractNestablePropertyAccessor.java:923) ~[spring-beans-5.3.17.jar:5.3.17]
	at org.springframework.beans.AbstractNestablePropertyAccessor.createDefaultPropertyValue(AbstractNestablePropertyAccessor.java:887) ~[spring-beans-5.3.17.jar:5.3.17]
	at org.springframework.beans.AbstractNestablePropertyAccessor.setDefaultValue(AbstractNestablePropertyAccessor.java:874) ~[spring-beans-5.3.17.jar:5.3.17]
	at org.springframework.beans.AbstractNestablePropertyAccessor.getNestedPropertyAccessor(AbstractNestablePropertyAccessor.java:846) ~[spring-beans-5.3.17.jar:5.3.17]
	at org.springframework.beans.AbstractNestablePropertyAccessor.getPropertyAccessorForPropertyPath(AbstractNestablePropertyAccessor.java:820) ~[spring-beans-5.3.17.jar:5.3.17]
	at org.springframework.beans.AbstractNestablePropertyAccessor.getPropertyAccessorForPropertyPath(AbstractNestablePropertyAccessor.java:821) ~[spring-beans-5.3.17.jar:5.3.17]
	at org.springframework.beans.AbstractNestablePropertyAccessor.getPropertyAccessorForPropertyPath(AbstractNestablePropertyAccessor.java:821) ~[spring-beans-5.3.17.jar:5.3.17]
	at org.springframework.beans.AbstractNestablePropertyAccessor.getPropertyAccessorForPropertyPath(AbstractNestablePropertyAccessor.java:821) ~[spring-beans-5.3.17.jar:5.3.17]
	at org.springframework.beans.AbstractNestablePropertyAccessor.setPropertyValue(AbstractNestablePropertyAccessor.java:256) ~[spring-beans-5.3.17.jar:5.3.17]
	at org.springframework.beans.AbstractPropertyAccessor.setPropertyValues(AbstractPropertyAccessor.java:104) ~[spring-beans-5.3.17.jar:5.3.17]
	at org.springframework.validation.DataBinder.applyPropertyValues(DataBinder.java:856) ~[spring-context-5.3.15.jar:5.3.15]
	at org.springframework.validation.DataBinder.doBind(DataBinder.java:751) ~[spring-context-5.3.15.jar:5.3.15]
	at org.springframework.web.bind.WebDataBinder.doBind(WebDataBinder.java:198) ~[spring-web-5.3.15.jar:5.3.15]
	at org.springframework.web.bind.ServletRequestDataBinder.bind(ServletRequestDataBinder.java:118) ~[spring-web-5.3.15.jar:5.3.15]
	at org.springframework.web.servlet.mvc.method.annotation.ServletModelAttributeMethodProcessor.bindRequestParameters(ServletModelAttributeMethodProcessor.java:158) ~[spring-webmvc-5.3.15.jar:5.3.15]
	at org.springframework.web.method.annotation.ModelAttributeMethodProcessor.resolveArgument(ModelAttributeMethodProcessor.java:171) ~[spring-web-5.3.15.jar:5.3.15]
	at org.springframework.web.method.support.HandlerMethodArgumentResolverComposite.resolveArgument(HandlerMethodArgumentResolverComposite.java:122) ~[spring-web-5.3.15.jar:5.3.15]
	at org.springframework.web.method.support.InvocableHandlerMethod.getMethodArgumentValues(InvocableHandlerMethod.java:179) ~[spring-web-5.3.15.jar:5.3.15]
	at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:146) ~[spring-web-5.3.15.jar:5.3.15]
	at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:117) ~[spring-webmvc-5.3.15.jar:5.3.15]
	at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:895) ~[spring-webmvc-5.3.15.jar:5.3.15]
	at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:808) ~[spring-webmvc-5.3.15.jar:5.3.15]
	at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87) ~[spring-webmvc-5.3.15.jar:5.3.15]
	at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1067) ~[spring-webmvc-5.3.15.jar:5.3.15]
	at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:963) ~[spring-webmvc-5.3.15.jar:5.3.15]
	at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1006) ~[spring-webmvc-5.3.15.jar:5.3.15]
	at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:909) ~[spring-webmvc-5.3.15.jar:5.3.15]
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:681) ~[servlet-api.jar:4.0.FR]
	at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:883) ~[spring-webmvc-5.3.15.jar:5.3.15]
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:764) ~[servlet-api.jar:4.0.FR]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:227) ~[catalina.jar:9.0.62]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) ~[catalina.jar:9.0.62]
	at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53) ~[tomcat-websocket.jar:9.0.62]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189) ~[catalina.jar:9.0.62]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) ~[catalina.jar:9.0.62]
	at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100) ~[spring-web-5.3.15.jar:5.3.15]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) ~[spring-web-5.3.15.jar:5.3.15]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189) ~[catalina.jar:9.0.62]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) ~[catalina.jar:9.0.62]
	at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93) ~[spring-web-5.3.15.jar:5.3.15]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) ~[spring-web-5.3.15.jar:5.3.15]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189) ~[catalina.jar:9.0.62]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) ~[catalina.jar:9.0.62]
	at org.springframework.boot.web.servlet.support.ErrorPageFilter.doFilter(ErrorPageFilter.java:126) ~[spring-boot-2.6.3.jar:2.6.3]
	at org.springframework.boot.web.servlet.support.ErrorPageFilter.access$000(ErrorPageFilter.java:64) ~[spring-boot-2.6.3.jar:2.6.3]
	at org.springframework.boot.web.servlet.support.ErrorPageFilter$1.doFilterInternal(ErrorPageFilter.java:101) ~[spring-boot-2.6.3.jar:2.6.3]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) ~[spring-web-5.3.15.jar:5.3.15]
	at org.springframework.boot.web.servlet.support.ErrorPageFilter.doFilter(ErrorPageFilter.java:119) ~[spring-boot-2.6.3.jar:2.6.3]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189) ~[catalina.jar:9.0.62]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) ~[catalina.jar:9.0.62]
	at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201) ~[spring-web-5.3.15.jar:5.3.15]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117) ~[spring-web-5.3.15.jar:5.3.15]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189) ~[catalina.jar:9.0.62]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) ~[catalina.jar:9.0.62]
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:197) ~[catalina.jar:9.0.62]
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97) ~[catalina.jar:9.0.62]
	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541) ~[catalina.jar:9.0.62]
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:135) ~[catalina.jar:9.0.62]
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92) ~[catalina.jar:9.0.62]
	at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:687) ~[catalina.jar:9.0.62]
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78) ~[catalina.jar:9.0.62]
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:360) ~[catalina.jar:9.0.62]
	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:399) ~[tomcat-coyote.jar:9.0.62]
	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65) ~[tomcat-coyote.jar:9.0.62]
	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:890) ~[tomcat-coyote.jar:9.0.62]
	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1743) ~[tomcat-coyote.jar:9.0.62]
	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) ~[tomcat-coyote.jar:9.0.62]
	at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191) ~[tomcat-util.jar:9.0.62]
	at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659) ~[tomcat-util.jar:9.0.62]
	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) ~[tomcat-util.jar:9.0.62]
	at java.base/java.lang.Thread.run(Thread.java:829) ~[na:na]
Caused by: java.lang.NoSuchMethodException: org.apache.catalina.WebResourceRoot.<init>()
	at java.base/java.lang.Class.getConstructor0(Class.java:3349) ~[na:na]
	at java.base/java.lang.Class.getDeclaredConstructor(Class.java:2553) ~[na:na]
	at org.springframework.beans.AbstractNestablePropertyAccessor.newValue(AbstractNestablePropertyAccessor.java:914) ~[spring-beans-5.3.17.jar:5.3.17]
	... 70 common frames omitted

Any ideas what I need to do to get the curl to complete?

Include LICENSE file

Could you please attach a license file, for example MIT, Apache 2.0, GPL. A license file would make clear what I am allowed to do with this code and what not.
About the background: I am a student at the University of Ulm and am currently writing my my master thesis.
For my empirical study I am investigating vulnerable projects and evaluating different security tools.
I would like to choose your project as one of my test cases for my empirical study.
However, since there is no license file available, I am not sure if I am allowed to use this code for my empirical study or not.
Thank you! :)