T3MP3ST public launch build

bench/cve-hunt/samples/CVE-2022-22965/source.java

@@ -0,0 +1,62 @@
+// Spring DataBinder + JDK9+ property navigation — pre-CVE-2022-22965 (Spring4Shell).
+// PropertyAccessor follows arbitrary nested setter chains from HTTP form params.
+// "class.module.classLoader.resources.context.parent.pipeline.first.pattern"
+// reaches Tomcat AccessLogValve.pattern → attacker-controlled JSP path → RCE.
+
+package org.springframework.beans;
+
+import javax.servlet.http.HttpServletRequest;
+import java.beans.Introspector;
+import java.beans.PropertyDescriptor;
+import java.lang.reflect.Method;
+import java.util.Map;
+
+public final class DataBinderUnsafe {
+
+    public void bind(Object target, HttpServletRequest req) throws Exception {
+        Map<String, String[]> params = req.getParameterMap();
+        for (Map.Entry<String, String[]> e : params.entrySet()) {
+            String  path  = e.getKey();          /* attacker-controlled */
+            String  value = e.getValue()[0];     /* attacker-controlled */
+            setNestedProperty(target, path, value);
+        }
+    }
+
+    /**
+     * BUG: traverses dotted paths through ANY introspectable getter chain
+     * without filtering "class"/"classLoader"/sensitive bean traversals.
+     * Under JDK9+ where Class.module is exposed, an attacker can navigate
+     * from any bean → getClass() → module → classLoader → ... → AccessLogValve
+     * → set pattern to an attacker-chosen log path that writes JSP.
+     */
+    private void setNestedProperty(Object root, String dottedPath, String value) throws Exception {
+        String[] parts = dottedPath.split("\\.");
+        Object   cur   = root;
+        for (int i = 0; i < parts.length - 1; ++i) {
+            cur = invokeGetter(cur, parts[i]);
+            if (cur == null) return;
+        }
+        invokeSetter(cur, parts[parts.length - 1], value);
+    }
+
+    private Object invokeGetter(Object obj, String prop) throws Exception {
+        PropertyDescriptor[] descs = Introspector.getBeanInfo(obj.getClass()).getPropertyDescriptors();
+        for (PropertyDescriptor d : descs) {
+            if (d.getName().equals(prop)) {
+                Method m = d.getReadMethod();
+                if (m != null) return m.invoke(obj);
+            }
+        }
+        return null;
+    }
+
+    private void invokeSetter(Object obj, String prop, String value) throws Exception {
+        PropertyDescriptor[] descs = Introspector.getBeanInfo(obj.getClass()).getPropertyDescriptors();
+        for (PropertyDescriptor d : descs) {
+            if (d.getName().equals(prop)) {
+                Method m = d.getWriteMethod();
+                if (m != null) { m.invoke(obj, value); return; }
+            }
+        }
+    }
+}