CVE-2022-22965
Spring Framework JDK 9+ Remote Code Execution Vulnerability
- Published
- Apr 1, 2022
- Updated
- Oct 21, 2025
- Assigning CNA
- vmware
- Evidence observed
- Apr 4, 2022
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HHigh · next 30 days
- Percentile
- 100.0%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
CISA Known Exploited
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Summary
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
Sources
spring/CVE-2022-22965
Spring Framework Data Binding Remote Code Execution on JDK 9+ (CVE-2022-22965)
Vulhub vulnerability labsDeclared conditions
- lab image version: vulhub/spring-webmvc:5.3.17(spring/CVE-2022-22965/docker-compose.yml:services.spring.image)
modules/exploits/multi/http/spring_framework_rce_spring4shell.rb
Metasploit Framework modulesDeclared conditions
- platform: Linux,Windows($.exploit_multi/http/spring_framework_rce_spring4shell.platform)
- verification: check_declared($.exploit_multi/http/spring_framework_rce_spring4shell.check)
- Spring - Remote Code ExecutionTemplate
http/cves/2022/CVE-2022-22965.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: word($.matchers[*].type)
- oob: interactsh_reference($.template_text)
- CVE-2022-22965Informational
Provides a detailed Spring4Shell (CVE-2022-22965) write-up covering root cause, exploitation conditions, impact, CVSS, and mitigation for vulnerable Spring apps.
- CVE-2022-22965Exploit
Exploit Of Spring4Shell!
- spring4shell_behinderExploit
CVE-2022-22965写入冰蝎webshell脚本
- CVE-2022-22965Scanner
Spring Framework RCE (CVE-2022-22965) Nmap (NSE) Checker (Non-Intrusive)
- CVE-2022-22965Exploit
Poc&Exp,支持批量扫描,反弹shell
Spring4Shell Proof Of Concept/And vulnerable application CVE-2022-22965
Proof-of-concept exploit for CVE-2022-22965 in Payara/Glassfish, demonstrating arbitrary file download via web root manipulation. Includes Docker setup and exploit script.
- spring4shell-pocExploit
Proof-of-concept exploit for Spring4Shell (CVE-2022-22965) that deploys a JSP webshell via crafted HTTP requests to vulnerable Spring Boot applications on Apache Tomcat.
CVE-2022-22965 proof of concept
Python-based proof-of-concept for CVE-2022-22965 (Spring4Shell) that writes a marker file to the Tomcat webapps directory and validates exploitation via HTTP request.
Spring4Shell (CVE-2022-22965) proof-of-concept with Docker lab, detailed vulnerability analysis, and debugging setup for educational exploitation research.
PowerShell port of CVE-2022-22965 vulnerability check by colincowie.
- Spring4ShellPoC
Spring rce environment for CVE-2022-22965
Dockerized Spring4Shell (CVE-2022-22965) proof-of-concept with Python exploit script and webshell deployment for educational vulnerability testing.
Educational analysis and proof-of-concept exploit for CVE-2022-22965, a Spring MVC/WebFlux remote code execution vulnerability via data binding on JDK 9+ with Tomcat WAR deployment.
Step-by-step walkthrough of exploiting CVE-2022-22965 (Spring4Shell) with Metasploit, deploying a C2 listener, and mitigating the vulnerability by downgrading to Java 8 on a Tomcat server.
- spring4shell-exploit-pocExploit
Exploit a vulnerable Spring application with the Spring4Shell (CVE-2022-22965) Vulnerability.
- go-scan-springExploit
Vulnerability scanner for Spring4Shell (CVE-2022-22965)
- spring4shell_victimResearch
Intentionally vulnerable Spring app to test CVE-2022-22965
Demonstrable Proof of Concept Exploit for Spring4Shell Vulnerability (CVE-2022-22965)
- CVE-2022-22965Informational
Vulnerabilidad RCE en Spring Framework vía Data Binding on JDK 9+ (CVE-2022-22965 aka "Spring4Shell")
Python exploit for CVE-2022-22965 (Spring4Shell) RCE vulnerability in Java Spring Core. Injects a JSP webshell via Tomcat log configuration to execute remote commands on vulnerable servers.
Docker-based proof-of-concept for CVE-2022-22965 (Spring4Shell) remote code execution vulnerability in Spring Boot 2.6.5, with automated webshell deployment and patch comparison.
- Spring-CVEExploit
This includes CVE-2022-22963, a Spring SpEL / Expression Resource Access Vulnerability, as well as CVE-2022-22965, the spring-webmvc/spring-webflux RCE termed "SpringShell".
- CVE-2022-22965Research
In-depth technical analysis of CVE-2022-22965 (Spring4Shell) with environment setup, debug walkthrough, and exploit chain breakdown for educational lab practice.
Proof-of-concept exploit for CVE-2022-22965 (Spring4Shell) demonstrating remote code execution via Tomcat AccessLogValve manipulation. Includes Docker-based reproduction environment and detailed technical analysis.
- CVE-2022-22965Exploit
Batch vulnerability scanner for CVE-2022-22965 (Spring4Shell) enabling automated detection and exploitation via JSP webshell injection across multiple targets.
- spring-core-rceExploit
Python-based exploit for CVE-2022-22965 (Spring4Shell) with vulnerability detection and webshell injection (Behinder/Godzilla) into Spring web applications.
- CVE-2022-22965Exploit
Python-based exploit for CVE-2022-22965 (Spring4Shell) with environment checks for Spring Framework, JDK version, Tomcat, and AccessLog configuration.
- CVE-2022-22965_Spring4ShellExploit
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
Description
- CVE-2022-22965Exploit
Proof-of-concept exploit for CVE-2022-22965 (Spring4Shell) with a vulnerable Spring Boot application, Python exploit script, and Docker-based lab environment for testing.
- CVE-2022-22965Exploit
Spring Framework RCE via Data Binding on JDK 9+ / spring4shell / CVE-2022-22965
- spring-core-rceExploit
CVE-2022-22965 : about spring core rce
- cve-2022-22965Exploit
Minimal Spring4Shell (CVE-2022-22965) exploit demonstration targeting Tomcat via class-loader manipulation, with a step-by-step curl-based attack chain for educational penetration testing.
- CVE-2022-22965Exploit
Spring4Shell
- Spring4Shell-Python-Firewall-POCDetection
Proof-of-Concept (POC) of a simple firewall in Python designed to mitigate the Spring4Shell (CVE-2022-22965) RCE attack by inspecting and blocking malicious request bodies.
- CVE-2022-22965Exploit
Spring-0day/CVE-2022-22965
- CVE-2022-22965Exploit
spring4shell | CVE-2022-22965
Proof of Concept for exploiting the CVE-2022-22965 (Spring4Shell) vulnerability in an isolated environment, with Remote Code Execution (RCE) demonstrated.
Dockerized Spring4Shell (CVE-2022-22965) PoC application and exploit
- spring4shell-CVE-2022-22965Exploit
Python-based proof-of-concept exploit for CVE-2022-22965 (Spring4Shell) with vulnerability checking, remote exploitation, and webshell command execution capabilities.
A comprehensive Security Operations Centre (SOC) incident response simulation demonstrating threat detection, triage, analysis, and mitigation of the Spring4Shell vulnerability (CVE-2022-22965).
- spring-shell-vulnResearch
Spring has Confirmed the RCE in Spring Framework. The team has just published the statement along with the mitigation guides for the issue. Now, this vulnerability can be tracked as CVE-2022-22965.
- Spring4Shell-CVE-2022-22965Exploit
Python-based proof-of-concept exploit for CVE-2022-22965 (Spring4Shell) targeting Java Spring Core RCE on Apache Tomcat. Uploads a JSP webshell with password protection for remote command execution.
CVE-2022-22965 (Spring4Shell) Proof of Concept
- SpringExploitGUIExploit
A comprehensive Spring vulnerability exploitation tool. The tool currently supports detection and exploitation of Spring Cloud Gateway RCE (CVE-2022-22947) and Spring Framework RCE (CVE-2022-22965).
批量无损检测CVE-2022-22965
Script to check for Spring4Shell vulnerability
- SpringShellExploit
Spring4Shell - Spring Core RCE - CVE-2022-22965
Spring4Shell - CVE-2022-22965
- CVE-2022-22965-pocExploit
CVE-2022-22965 poc including reverse-shell support
Reproduces the Spring4Shell (CVE-2022-22965) remote code execution vulnerability with a Python exploit script, deploying a JSP webshell on Apache Tomcat for testing and verification.
CVE-2022-22965\Spring-Core-RCE is comparable to the one-click RCE exploit of the nuclear-level vulnerability Apache Log4j2 exploit.
CVE-2022-22965 proof of concept for CS4239 report
Python exploit for Spring Framework CVE-2022-22965 remote code execution with webshell deployment and Burp payload support for penetration testing.
- CVE-2022-22965Exploit
Spring4Shell (CVE-2022-22965)
This is a dockerized application that is vulnerable to the Spring4Shell vulnerability (CVE-2022-22965).
PoC and exploit for CVE-2022-22965 Spring4Shell
- spring-core-rceExploit
spring框架RCE漏洞 CVE-2022-22965
- CVE-2022-22965Exploit
Proof-of-concept exploit and testing scripts for Spring4Shell (CVE-2022-22965), a Spring Framework remote code execution vulnerability, with bash and Python implementations.
SpringFramework 远程代码执行漏洞CVE-2022-22965
- CVE-2022-22965Exploit
CVE-2022-22965 POC
Exploit attempt for CVE-2022-22965 (Spring4Shell) targeting Spring Framework applications for remote code execution.
User friendly Spring4Shell POC
Spring Framework RCE (Quick pentest notes)
- CVE-2022-22965Exploit
C-based exploit for Spring4Shell (CVE-2022-22965) remote code execution vulnerability in Spring Core framework.
Proof-of-concept exploit for CVE-2022-22965 (Spring4Shell) targeting Java Spring Framework applications via crafted HTTP requests.
- Spring4Shell-CVE-2022-22965Exploit
EXP for Spring4Shell(CVE-2022-22965)
Proof of concept code for Datadog Security Labs referenced exploits.
The demo code showing the recent Spring4Shell RCE (CVE-2022-22965)
CVE-2022-22965 - CVE-2010-1622 redux
Java-based tool to detect and test for CVE-2022-22965 (Spring4Shell) vulnerability in web applications, enabling security validation and exploitation assessment.
- nmap-spring4shellExploit
Nmap NSE script for detecting and exploiting Spring4Shell (CVE-2022-22965) RCE vulnerability in HTTP services with configurable payload injection and command execution.
- Fast-CVE-2022-22965Exploit
Graphical detection tool for CVE-2022-22965 (Spring4Shell) with one-click reverse shell generation, command execution, and multi-server shell path adaptation.
- irule-cve-2022-22965Patch
F5 BIG-IP iRule providing mitigation against CVE-2022-22965 (Spring4Shell) remote code execution vulnerability in Java Spring Framework. Tested on BIG-IP 15.x.
- Spring4ShellResearch
In this challenge, I analyzed the Spring4Shell (CVE-2022-22965) vulnerability, investigated security bypasses, and wrote an Incident Postmortem Report detailing the detection, impact, and resolution of the attack. I also implemented a firewall rule in Python to block malicious requests and prevent future exploitation.
CVE-2022-22965 Environment
- CVE-2022-22965-Spring4ShellExploit
Exploit for CVE-2022-22965 (Spring4Shell) enabling remote code execution on unpatched Spring Framework applications via crafted HTTP requests.
- Spring4ShellExploit
Spring4Shell , Spring Framework RCE (CVE-2022-22965) , Burpsuite Plugin
- CVE-2022-22965Exploit
Spring4Shell Vulnerability RCE - CVE-2022-22965
- CVE-2022-22965Exploit
Spring Framework RCE exploit (CVE-2022-22965) with analysis code and educational walkthrough for understanding the vulnerability and exploitation mechanism.
- GhostStrikeExploit
Fully automated Spring4Shell (CVE-2022-22965) + GitLab RCE framework
Another spring4shell (Spring core RCE) POC
exploitation script tryhackme
Exploit for CVE-2022-22965 (Spring4Shell) targeting Spring Framework versions vulnerable to remote code execution via classLoader manipulation.
Spring4Shell PoC (CVE-2022-22965)
- spring-framework-rceExploit
CVE-2022-22965
- CVE-2022-22965-rexbbExploit
CVE-2022-22965\Spring-Core-RCE: A graphical GUI one-click exploitation tool for the nuclear-level RCE vulnerability, developed with JavaFx. The graphical interface makes operation simpler and improves efficiency.
CVE proof-of-concept labs, exploit scripts, and detection/prevention rules (Nginx, Apache, Snort, YARA) for high-severity CVEs. Authorized security testing & research only.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.