CVE-2022-22965 Spring4Shell Analysis

Vulnerability Description

Spring4Shell is the name of a CVE existing on Spring Core of the Spring Framework.

With a CVSS 3.x score of 9.8, the vulnerability is classified as the highest risk level (critical). This vulnerability allows an attacker to execute remote code and control the vulnerable server.

Along with the popularity of Spring Core on the internet and the severe impact of Spring4Shell, this vulnerability is considered by experts to be no less influential than Log4shell.

Affected Scope

Spring4Shell does not affect all web applications using Spring Framework on the internet; it requires the web application to have the following factors:

• The application uses Spring Framework version < 5.2, 5.2.0 – 5.2.19, or 5.3.0 - 5.3.17
• The application uses one of the two dependencies Spring-webmvc or Spring-webflux
• The application uses Java with JDK version >= 9
• The application is packaged as a traditional Java web archive (a .war file) and deployed in Tomcat (no vulnerability has been found on applications running with Springboot)

Environment Setup

The environment I set up has the following parameters:

• Spring Framework 5.1.0
• Spring-webmvc dependency 5.1.0
• JDK 11.0.13 (I use Kali 2021.4a VM and this Java version is pre-installed)
• Apache Tomcat 9.0.45

Creating a vulnerable environment, project, and setting up debug with Intellij

1. Install Apache Tomcat

   As mentioned above, I use Kali 2021.4a and Apache Tomcat 9.0.45. If you do not know how to install Apache Tomcat and want to install it on Kali Linux, you can refer to this link.

   Note: Replace the link https://mirror.kiu.ac.ug/apache/tomcat/tomcat-9/v9.0.45/bin/apache-tomcat-9.0.45.tar.gz with https://archive.apache.org/dist/tomcat/tomcat-9/v9.0.45/bin/apache-tomcat-9.0.45.tar.gz

2. Choose an IDE

   We need an IDE to code the project, package it as a .war file, and most importantly, debug. I use Intellij; you can use Eclipse or Netbeans as well, as long as the IDE supports Java.

3. Create a simple vulnerable project

   My project is very simple, consisting of:

   • a model HelloWorld.java

     

   • a controller HelloWorldController.java

     

   • a view hello.jsp

     

4. Build the .war file

   To package the project, do the following: Build -> Build Artifacts -> helloworld:war -> Build.

   Wait for the Build process to succeed; at this point, the project will have an additional folder out. Go to ./out/artifacts/your_war_name/ and you will find a file your_war_name.war. This .war file is the compiled and packaged web project, which can be used for deployment on Java Servlets such as Apache Tomcat.

   If Build Artifacts is grayed out (cannot Build Artifacts), it means Build Artifacts has not been set up for this project. Go to: File -> Project Structure -> Artifacts -> Delete all existing artifacts -> Add (the + sign) -> Web Application: Exploded -> From Modules... -> OK (finish creating Exploded) -> Add (the + sign) -> Web Application: Archive -> For ‘helloworld:war exploded’ -> OK. Then repeat the Build Artifacts process.

5. Deploy and set up debug

   • Deploy

     To deploy a .war file to Apache Tomcat, simply copy the .war file into the /webapps directory inside the Apache Tomcat folder (e.g., I copy the file helloworld.war (I renamed it for convenience) into /opt/tomcat/apache-tomcat-9.0.45/webapps/). Then, start the Tomcat server using one of two methods (for Linux):

     • /opt/tomcat/apache-tomcat-9.0.45/bin/catalina.sh start (the application will run with the privileges of the user executing this command; for me, it is root)
     • sudo service tomcat start (the application usually runs with the tomcat user, depending on how you configured the service during Apache Tomcat setup)

     After deploying, access http://localhost:8080/helloworld

   • Set up debug

     To set up remote debug for Tomcat, do the following:

     1. On the server side:

        • Open the catalina.sh file and change the value of localhost to the VM's IP address in the JPDA_ADDRESS parameter

          

        • Restart the Tomcat server with: /opt/tomcat/apache-tomcat-9.0.45/bin/catalina.sh jpda start. At this point, besides opening port 8080 for HTTP Server, Tomcat will also open port 8000 for us to connect and debug.

        Note: In this debug section, I am running Intellij on Windows 10 and Tomcat on a Kali VM, so I need to change JDPA_ADDRESS. If you set up both Intellij and Tomcat on the same machine, no change is needed.

     2. On the Intellij side:

        • Go to Run -> Edit Configurations... -> Add (the + sign) -> Remote JVM Debug

        • Set a name -> Modify Host and Port to the IP and port you set in the catalina.sh file -> OK -> Shift + F9 (start Debug)

          

Detailed Analysis

First, I will analyze the project I am using for debugging. As mentioned above, this project simply consists of:

• A model HelloWorld.java, where the HelloWorld object has two attributes: message (string) and person (string), along with setter and getter functions (due to this simple structure, this object is called a Plain Old Java Object - POJO). The project must contain a POJO class – this is a necessary condition for exploiting the Spring4Shell vulnerability.
• A controller HelloWorldController.java, which contains a function helloPost with input parameters consisting of an object helloWorld (HelloWorld) and a model (Model). In the helloPost function, it adds attributes to the model object from the values of the helloWorld attributes (person and message) – The second condition for exploiting Spring4Shell is having a controller that accepts a POJO object as input.
• A view hello.jsp, which calls the attributes in the model (sent from the controller HelloWorldController.java) and displays them to the user.

Here is an example:

The application takes information from the POST request parameters and creates a helloWorld object {“person”:”Leo”, “message”:”Hi there”}. This helloWorld object is the input for the helloPost function. The application performs the steps I described above to return the response to the user.