Spring4Shell Vulnerability (CVE-2022-22965)

Spring4Shell Vulnerability (CVE-2022-22965)

Spring is one of the most popular and most widely used Java frameworks –  ~70% of all Java applications use it – so any security issue found in its core functionalities means bad news for a lot of people. Hence the high level of attention paid by the entire cyber industry. The newly discovered vulnerability in the popular Java Spring framework, dubbed Spring4Shell,

Exploitation of Spring4Shell will allow an attacker to remotely execute arbitrary code on the target server, usually with equivalent permissions to the vulnerable web server itself. A successful attack might allow a user to access all website internal data, including possible access to any connected database. It may also allow an attacker to access additional internal resources to gain more permissions or to pivot to other parts of the internal network.

Spring4Shell: An confirmed RCE in Spring Core <=5.3.17. CVE Added (3/31/2022): CVE-2022-22965-

RCE in "Spring Core"​- Users running JDK version 9 and newer are vulnerable to an RCE attack. All versions of Spring Core are impacted. It is recommend that apply mitigations if running Spring Core.

CVE-2022-22963: A confirmed RCE in Spring Cloud Function (<=3.1.6 and <=3.2.2).

RCE in "Spring Cloud Function"​ (CVE-2022-22963) -If you're using the Spring Cloud Function library, you must upgrade to 3.1.7+ or 3.2.3+ to prevent an RCE attack.

Spring4Shell PoC Application:

-Build and run the container: (https://github.com/reznok/Spring4Shell-POC)

• docker build . -t spring4shell && docker run -p 8080:8080 spring4shell

-App should now be available at http://<IP>:8080/helloworld/greeting

-Run the exploit.py script: python exploit.py --url "http://<IP>:8080/helloworld/greeting"

-Visit the created webshell! Modify the cmd GET parameter for your commands.

Run other commands as listed below-

Note: Patches are now available for Spring4Shell in Spring versions 5.3.18 and 5.2.20 and an official CVE has been published as CVE-2022-22965.

Reference: 

• https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities/
• https://securityboulevard.com/2022/03/spring4shell-what-happened-whos-vulnerable-and-how-to-mitigate/