guayoyocyber/cve-2022-22965Vulnerabilidad RCE en Spring Framework vía Data Binding on JDK 9+ (CVE-2022-22965 aka "Spring4Shell")
RCE vulnerability in Spring Framework via Data Binding on JDK 9+
The goal is to centralize as much publicly known information as possible to date about the vulnerability and to know what actions to take in such a case.
The conditions (AND) that must be met are:
As of today, it is not vulnerable to the exploit. But keep in mind that this vulnerability is more general in nature, so there could be other ways to exploit it.
Spring Framework
Older or no longer supported versions are also affected.
Spring Framework
In case patching the vulnerability is not possible, Spring published some workarounds.
Apache Tomcat has released 3 new versions that offer adequate protection: 10.0.20, 9.0.62 and 8.5.78, and it is suggested that they be considered as an additional layer of protection to the Spring Framework update.
Spring Boot versions 2.6.6 and 2.5.12 were released, which depend on Spring Framework 5.3.18.
You can use the tool https://github.com/hillu/local-spring-vuln-scanner (mirror) to detect instances vulnerable to Spring4Shell. A possible execution example is:
./local-spring-vuln-scanner --verbose --log </path/to/file.log> </path/to/app1> </path/to/appN>
We have developed a detection rule for Wazuh that you can find in the "detection" directory of this repository, which, based on a set of attack indicators (IOA), makes it possible to detect attack attempts.
There was speculation about a commit regarding the confirmation to deprecate the use of the SerializationUtils.deserialize(...) method. This class is not exposed to external inputs and the deprecation is not related to this vulnerability.
There was confusion with a CVE for Spring Cloud Function that was published just before the disclosure of this vulnerability CVE-2022-22963. It is also not related.
TryHackMe has created an interactive Spring4Shell exploitation lab
