CVE-2022-30929
📋 TL;DR
Mini-Tmall v1.0 has insecure permissions in tomcat-embed-jasper that allow attackers to bypass authentication and access sensitive files or execute arbitrary code. This affects all deployments of Mini-Tmall v1.0 using the vulnerable tomcat-embed-jasper component. Attackers can exploit this to compromise the entire application server.
💻 Affected Systems
- Mini-Tmall
📦 What is this software?
Mini Tmall by Mini Tmall Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing remote code execution, data theft, and lateral movement within the network.
Likely Case
Unauthorized access to sensitive configuration files, source code, and potentially credential theft leading to further exploitation.
If Mitigated
Limited impact with proper network segmentation and access controls preventing exploitation attempts.
🎯 Exploit Status
Public exploit code available on GitHub, simple HTTP requests can trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
1. Remove or upgrade Mini-Tmall v1.0 entirely. 2. Replace with a secure alternative. 3. Update tomcat-embed-jasper to latest secure version if continuing to use similar components.
🔧 Temporary Workarounds
Remove JSP file access
allConfigure Tomcat to deny access to JSP files through web.xml security constraints
Add to web.xml: <security-constraint><web-resource-collection><url-pattern>*.jsp</url-pattern></web-resource-collection><auth-constraint/></security-constraint>
Network isolation
linuxRestrict network access to vulnerable systems using firewall rules
iptables -A INPUT -p tcp --dport 8080 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to isolate vulnerable systems
- Deploy web application firewall (WAF) with rules to block JSP file access attempts
🔍 How to Verify
Check if Vulnerable:
Check if Mini-Tmall v1.0 is installed and accessible, then attempt to access JSP files without authentication via HTTP requests.Check Version:
Check application version in web interface or configuration files; look for 'Mini-Tmall v1.0' references.Verify Fix Applied:
Test that JSP files are no longer accessible without proper authentication and that the application functions normally.📡 Detection & Monitoring
Log Indicators:
- Unusual access to .jsp files in Tomcat logs
- 401/403 errors followed by successful 200 responses to JSP files
- Requests with suspicious parameters to JSP endpoints
Network Indicators:
- HTTP requests to *.jsp files from unexpected sources
- Unusual traffic patterns to Tomcat default ports (8080, 8443)
SIEM Query:
source="tomcat_access.log" AND (uri="*.jsp" OR uri="*.jspx") AND response="200" AND user="-"