Spring-Core-RCE Spring Framework Remote Command Execution Vulnerability (CVE-2022-22965)

Spring-Core-RCE is comparable to the Apache Log4j2 nuclear-level vulnerability exp for one-click RCE exploitation

Overview

Recently, a remote command execution vulnerability regarding Spring Core was mentioned in the Spring official GitHub issue. This vulnerability widely exists in the Spring framework and its derived frameworks.

Vulnerability Description

Spring Core is a toolkit in the Spring product series responsible for discovering, creating, and handling relationships between beans. It is a core toolkit containing the basic Spring framework, and other Spring components must use this package.

Unauthenticated attackers can use this vulnerability to perform remote arbitrary code execution. This vulnerability widely exists in the Spring framework and its derived frameworks. JDK 9.0 and above are affected. Products using older JDK versions are not affected. It is recommended that enterprises with this vulnerability block requests containing special strings at the firewall to avoid attacks.

Vulnerability Reproduction

One-Click POC Exploitation

Setting Up the Vulnerability Environment

0x01. Use Docker to download: docker pull vulfocus/spring-core-rce-2022-03-29

0x02. Run the target container

docker run -d -p 8080:8080 vulfocus/spring-core-rce-2022-03-29:latest

0x03. Visit http://127.0.0.1:8080/ - if 'ok' appears, the service is running normally

0x04. Use the exploit to attack

0x05. Obtain highest privileges:

Visit http://127.0.0.1:8080/tomcatwar.jsp?pwd=j&cmd=whoami

Affected Scope

Spring framework and its derived frameworks are affected. (JDK version must be 9.0 or above.)

According to the latest FOFA system data (within one year), there are a total of 7,023,506 related services exposed globally (using the above FOFA query statement). China has the highest number with 2,987,121; the United States second with 1,215,955; Brazil third with 381,319; South Korea fourth with 219,201; Germany fifth with 213,097.

Global distribution is as follows (distribution only, not vulnerability impact scope)

Remediation Suggestions

Upgrade Spring Framework version

Spring Framework == 5.3.18 

Spring Framework == 5.2.20

Temporary Defense Measures:

1. WAF Defense.

Add the following rules to the WAF to filter special input strings:

Class.*

class.*

*.class.*

*Class.*

2. Protection via blacklist strategy.

In the affected product code, search for the @InitBinder annotation and check if the method body contains the dataBinder.serDisallowerFields method. If found, add the following filtering rules to the blacklist:

Class.*

class.*

*.class.*

*Class.*

References

[1] https://github.com/spring-projects/spring-framework/issues/27483

[2] https://github.com/google/tsunami-security-scanner-plugins/issues/234