Exploitation of vulnerability CVE-2022-22965

The vulnerability CVE-2022-22965, known as Spring4Shell, is a remote code execution (RCE) flaw in the Java Spring Core framework, present in versions prior to 5.3.18 and 5.2.20. This vulnerability allows an attacker to inject and execute code remotely on a vulnerable server by exploiting a misconfiguration in Tomcat logging. It was discovered in March 2022 and affects activeMQ, Spring MVC, and Spring WebFlux applications running with JDK >= 9.

We first ensure that we have a JDK version >= 9, if not we activate it:

Prerequisites ✔ The requests and BeautifulSoup modules are required for the exploit to work. We install them with:

pip3 install bs4
pip3 install requests

Network Scan

Here, we have the activeMQ service version 5.17.3 listening.

In our exploit strategy we will use a developed Python script named spring4shell.py attached to this project.

Objective of this script: This Python script exploits the CVE-2022-22965 flaw by modifying Tomcat logging parameters to inject a webshell into log files, allowing remote command execution on the compromised server.

Explanation of the Python Code

  Terminal output configuration:
      The settings class adapts terminal display according to chosen options, with colors to differentiate information, warning, and error messages.
  Random variable generation:
      The filename() and password() functions generate random hexadecimal strings to secure the filename and password of the webshell.
  Exploitation of the vulnerability:
      The script sends requests to modify Tomcat logging parameters, injecting JSP code fragments via logs. By configuring logs to write into the webapps/ROOT directory, each entry becomes interpretable as JSP code.
      The injected log file then acts as a webshell accessible via a browser to execute commands.
  Interaction with the Webshell:
      The terminal class opens an interactive interface allowing commands to be sent to the compromised server. Commands are sent as the cmd parameter, and responses are displayed in the terminal.

After executing the script, a link to the webshell is provided: Via the command:

python3 spring4shell.py http://172.17.0.1

We obtain direct shell access to our activemq server in order to execute any commands we wish.

End of exploit !!!