ludovicpatho/cve-2022-22965_spring4shellA Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CVE-2022-22965 (Spring4Shell, SpringShell) is a vulnerability in the Spring Framework that uses data binding functionality to bind data stored within an HTTP request to certain objects used by an application. The bug exists in the getCachedIntrospectionResults method, which can be used to gain unauthorized access to such objects by passing their class names via an HTTP request. It creates the risks of data leakage and remote code execution when special object classes are used. This vulnerability is similar to the long-closed CVE-2010-1622, where class name checks were added as a fix so that the name did not match classLoader or protectionDomain.
According to the CVSSv3 system, it scores as CRITICAL severity.
Below are detection opportunities for CVE-2022-22965 that can be used to identify vulnerability.
Current conditions for vulnerability (as stated in Spring's announcement of the vulnerability) can be summarised as follows:
python3 exploit.py http://10.10.10.10/
Note: the trailing slash is very important here!
Look for the "action" of the contact form (the only POST request available to us).
<form id="contactForm" action="/" method="post">
The action is "/", meaning that our target URL will simply be: http://10.10.10.10/