This is a Proof of Concept (PoC) demonstrating the vulnerability CVE-2022-48565, which is based on unsafe deserialization of Plist files in Python. By processing specially crafted Property List (Plist) files, an attacker can execute arbitrary code on the target system, potentially leading to Remote Code Execution (RCE).
In this repository, you will find four PoC scripts, each showing different ways to exploit this vulnerability. These examples demonstrate how malicious code can be embedded in Plist files and executed on a system.
These PoC scripts are for educational purposes and security research only. Use these scripts in a controlled environment and never on production systems. Misuse of this vulnerability could result in serious legal and ethical consequences.
-
Python <=3.9.1
-
Python 2.x
-
macOS: Some examples (e.g., opening the Calculator or Safari) only work on macOS, as they use macOS-specific commands
Clone this repository:
git clone https://github.com/Einstein2150/CVE-2022-48656-POC
Change into the directory:
cd CVE-2022-48656-POC
There are four PoC scripts, each showing different ways to exploit this vulnerability.
This script shows a simple example where unsafe deserialization is used to execute a shell command that prints a message to the console.
Usage:
bash
python2 cve-2022-48565_poc_echo.py
In this example, it is demonstrated how an attacker can open the macOS Calculator by deserializing a malicious Plist file.
Usage:
bash
python2 cve-2022-48565_poc_calc.py
This script shows how an attacker can download a file from an external source and automatically open it in Safari. The wget command is used to download index.html from the website foto-video-it.de, which is then opened in Safari.v
Usage:
bash
python2 cve-2022-48565_poc_wget.py
This script simulates a practical attack scenario where the malicious Plist file is stored externally and loaded at runtime. This demonstrates how an attacker can load a Plist file from an external source and use it to execute malicious code.
The malicious.plist file contains the payload and must be placed in the same directory as the script.
Usage:
bash
python2 cve-2022-48565_poc_external_plist.py
This project is licensed under the MIT License. See the LICENSE file for more details.