Spring Framework Vulnerabilities - CVE-2022-22965

List of vulnerable / non-vulnerable software

https://github.com/NCSC-NL/spring4shell/blob/main/software/README.md

Finding vulnerable code

Prerequisites for being vulnerable to CVE-2022-22965:

1) Use of Spring Framework

See PowerShell and bash scripts below.

2) The Spring Framework versions must be vulnerable; this applies in principle to all versions earlier than 5.3.18 and 5.2.20.

Hilko Bengen has published a scanner that searches for vulnerable versions of CachedIntrospectionResults.class based on versions here: https://github.com/hillu/local-spring-vuln-scanner

3) Use of JDK9 or newer, and running JRE 9 or newer.

This can be found by running:

java -version

on the relevant systems.

Note that Java applications can be run in many different ways, and you may have multiple versions installed simultaneously. To be sure which Java version is running, you can first identify where the java binary is executed from, and then check which version that specific java binary is.

In Linux, this can be done by running:

ps aux | grep java

where you might find /usr/lib/jvm/java-11-openjdk-amd64/bin/java, and you can then run the following command using the absolute path:

$ /usr/lib/jvm/java-11-openjdk-amd64/bin/java -version
openjdk version "11.0.14.1" 2022-02-08
OpenJDK Runtime Environment (build 11.0.14.1+1-Ubuntu-0ubuntu1.18.04)
OpenJDK 64-Bit Server VM (build 11.0.14.1+1-Ubuntu-0ubuntu1.18.04, mixed mode, sharing)

Similarly, in Windows, you can find the absolute path of running Java processes either using WMI or PowerShell:

WMI: C:\> wmic process where "name='java.exe'" get ExecutablePath
PowerShell: PS C:\> Get-Process java | Select-Object Path

4) The code that uses Spring Framework must also use specific methods with specific parameters for an attacker to exploit the vulnerability.

JFrog has published Python code that identifies the use of this, and it can be used directly on compiled Java programs so that you don't need to extract .jar/.war files: https://github.com/jfrog/jfrog-spring-tools

When it comes to identifying Spring Framework on the system, it depends on which operating system is running:

Windows

The following PowerShell scripts to find potentially vulnerable applications, i.e., applications that use or are based on Spring Framework. Note that these scripts will not differentiate between updated versions or not, but they will identify systems that are likely to have the vulnerability as of now, per point 1 above.

Search for spring-beans*.jar and cachedintrospectionresults.class in *.war files on the system:

$SearchName = "*.war"
$Drives = Get-WmiObject Win32_LogicalDisk -Filter 'DriveType=3' | Select -ExpandProperty DeviceID
#$Drives = Get-CimInstance Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID 
#powershell version 6

$Vulnerable = $false
$entries = @()
$hits = @()
$search1 = "spring-beans*.jar"
$search2 = "cachedintrospectionresults.class"
Foreach ($drive in $drives) {
    $SearchDir = "$drive\"
    $wars= (&cmd /c pushd $searchDir `& robocopy /l "$searchDir" null "$searchName" /ns /njh /njs /np /nc /ndl /xjd /mt /s)  -replace '^\s+|\s+$'
        
    Foreach ($war in $wars){
        If($war) {
            #$war
            Add-Type -AssemblyName System.IO.Compression
            Add-Type -AssemblyName System.IO.Compression.FileSystem
            $entries = ([System.IO.Compression.ZipArchive](https://github.com/helsecert/cve-2022-22965/blob/HEAD/%5BSystem.IO.Compression.ZipFile%5D::OpenRead($war))).Entries
            foreach ($entry in $entries){
                if ($entry.Name -like $search1) {
                    "$($war)\$($entry.FullName)"
                    $hits = $hits +1
                    }
                if ($entry.Name -like $search2) {
                    "$($war)\$($entry.FullName)"
                    $hits = $hits +1
                    }
                }
            
        }
    
    }
    
}
If ($hits){ "Vulnerable" }
Else { "Compliant" }

Furthermore, searching for cachedintrospectionresults.class across all .jar files is useful, and we know that it is not always spring-beans*.jar that contains this class.

$SearchName = "*.jar"
$Drives = Get-WmiObject Win32_LogicalDisk -Filter 'DriveType=3' | Select -ExpandProperty DeviceID
#$Drives = Get-CimInstance Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID 
#powershell version 6

$Vulnerable = $false
$entries = @()
$hits = @()
$search1 = "cachedintrospectionresults.class"
Foreach ($drive in $drives) {
    $SearchDir = "$drive\"
    $wars= (&cmd /c pushd $searchDir `& robocopy /l "$searchDir" null "$searchName" /ns /njh /njs /np /nc /ndl /xjd /mt /s)  -replace '^\s+|\s+$'
        
    Foreach ($war in $wars){
        If($war) {
            #$war
            Add-Type -AssemblyName System.IO.Compression
            Add-Type -AssemblyName System.IO.Compression.FileSystem
            $entries = ([System.IO.Compression.ZipArchive](https://github.com/helsecert/cve-2022-22965/blob/HEAD/%5BSystem.IO.Compression.ZipFile%5D::OpenRead($war))).Entries
            foreach ($entry in $entries){
                if ($entry.Name -like $search1) {
                    "$($war)\$($entry.FullName)"
                    $hits = $hits +1
                    }
                }
            
        }
    
    }
    
}
If ($hits){ "Vulnerable" }
Else { "Compliant" }

Linux

For searching on Linux, you can look for the class cachedintrospectionresults.class in all .jar and .war files on disk, as well as search for spring-beans*.jar in *.war files:

find / -name '*.jar' -exec grep -Fi 'cachedintrospectionresults.class' {} \;
find / -name '*.war' -exec grep -Ei 'cachedintrospectionresults\.class|spring-beans.*\.jar' {} \;

as well as search for the same class name in .jar files that are inside .war files:

#!/bin/bash

find / -name '*.war' -print0 2>/dev/null -print0 | while read -d $'\0' spring; do
        echo -en "${spring}: "$(unzip -p "${spring}" '*.jar' | strings | grep -Fi 'cachedintrospectionresults.class' | awk '{ print $NF }')"\n"
done
exit 0