Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Spring4Shell-POC — Proof of Concept for exploiting the CVE-2022-22965 (Spring4Shell) vulnerability in an isolated environment, with Remote Code Execution (RCE) demonstrated. | Kitploit
Tools/GitHubGitHub/princeh4k/spring4shell-poc
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & EducationPayload DevelopmentLabs & Practice
GitHubprinceh4k/spring4shell-poc

Spring4Shell-POC

Proof of Concept for exploiting the CVE-2022-22965 (Spring4Shell) vulnerability in an isolated environment, with Remote Code Execution (RCE) demonstrated.

View Repository
31 month agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Spring4Shell (CVE-2022-22965) - Remote Code Execution Proof of Concept

CVE Spring Framework Apache Tomcat Java Docker

A fully containerized Proof of Concept (PoC) demonstrating the exploitation of Spring4Shell (CVE-2022-22965), resulting in Remote Code Execution (RCE) against a vulnerable Spring Framework application deployed on Apache Tomcat.

The project recreates the complete vulnerable environment to facilitate security research, penetration testing practice, vulnerability analysis, and defensive learning in a safe and reproducible laboratory.

Disclaimer

This repository is provided strictly for educational, research, and authorized security testing purposes. The vulnerable environment is intentionally insecure and must only be executed in isolated lab conditions. The author assumes no responsibility for misuse or any damage resulting from the use of this project.

Overview

Spring4Shell (CVE-2022-22965) is a critical Remote Code Execution vulnerability affecting specific versions of the Spring Framework when deployed on Apache Tomcat under particular runtime conditions.

This repository provides a fully reproducible laboratory environment that allows researchers and students to understand:

  • how the vulnerability works;
  • the exploitation workflow;
  • the conditions required for successful exploitation;
  • practical mitigation strategies.

The application is completely isolated inside a Docker container, allowing experimentation without affecting the host operating system.

Target Environment

ComponentVersionDescription
Spring Boot2.6.2Vulnerable application
Spring Framework5.3.14Vulnerable version
Apache Tomcat9.0.60Servlet container
JavaJDK 11Required runtime
Operating SystemUbuntu 24.04Docker container

Repository Structure

root@kitploit:~
.
├── Dockerfile
├── pom.xml
├── src/
│   ├── main/
│   └── test/
├── README.md
└── exploit/

Getting Started

Clone the repository

root@kitploit:~
git clone https://github.com/<username>/<repository>.git
cd <repository>

Build the Docker image

root@kitploit:~
docker build -t spring4shell:2.6.2 .

Run the vulnerable application

root@kitploit:~
docker run -p 8080:8080 spring4shell:2.6.2

The application will be available at:

root@kitploit:~
http://localhost:8080

Exploitation Workflow

The repository demonstrates the complete attack chain:

  1. Deploy the vulnerable application.
  2. Verify exploit prerequisites.
  3. Deliver the malicious payload.
  4. Modify Tomcat logging configuration.
  5. Write the malicious JSP web shell.
  6. Execute arbitrary commands through the deployed shell.

Learning Objectives

This project covers several important offensive security concepts:

  • Spring MVC Data Binding
  • Java Reflection
  • Apache Tomcat internals
  • Remote Code Execution (RCE)
  • Web Application Security
  • Vulnerability Reproduction
  • Secure Lab Deployment
  • Defensive Analysis

Mitigation

To mitigate CVE-2022-22965:

  • Upgrade to a patched version of the Spring Framework.
  • Upgrade Apache Tomcat where applicable.
  • Apply the official Spring Security advisories.
  • Restrict unnecessary data binding.
  • Continuously patch application dependencies.
  • Never expose intentionally vulnerable environments to public networks.

References

  • CVE-2022-22965
  • Spring Security Advisory
  • VMware Security Advisory
  • Apache Tomcat Documentation
  • NIST National Vulnerability Database (NVD)

⭐ If you find this project useful for learning or security research, consider giving it a star ⭐

Download Tool