Full Report
What we know about Spring4Shell so far
Analysis Summary
# Vulnerability: Spring4Shell Remote Code Execution (RCE)
## CVE Details
- **CVE ID:** CVE-2022-22965
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-94 (Improper Control of Generation of Code / Code Injection)
## Affected Systems
- **Products:** Spring Framework
- **Versions:** 5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and older unsupported versions.
- **Configurations:** The vulnerability specifically requires:
- Running on Java 9 or higher.
- Apache Tomcat as the Servlet container.
- Packaged as a traditional Web Archive (WAR) file.
- Dependency on `spring-webmvc` or `spring-webflux`.
- Usage of `@RequestMapping` annotations and POJO (Plain Old Java Object) parameters.
## Vulnerability Description
Spring4Shell is a critical Remote Code Execution (RCE) vulnerability in the Spring Framework. It stems from the way Spring handles data binding. By utilizing specific class-loading features introduced in Java 9, an attacker can manipulate the `ClassLoader` through HTTP parameters. In a Tomcat environment, this allow an attacker to override logging properties to create a JSP webshell in the server's web directory, leading to full remote command execution.
## Exploitation
- **Status:** PoC available and exploited in the wild.
- **Complexity:** Low
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Full data access)
- **Integrity:** High (System modification/Webshell installation)
- **Availability:** High (Potential for system shutdown or disruption)
## Remediation
### Patches
- **Spring Framework:** Upgrade to version **5.3.18** or **5.2.20**.
- **Spring Boot:** Upgrade to version **2.6.6** or **2.5.12** (which consume the patched Spring Framework versions).
### Workarounds
- **Disallow Fields:** Apply a global `WebDataBinder` configuration to block specific patterns such as `{"class.*", "Class.*", "*.class.*", "*.Class.*"}`.
- **WAF:** Implement Web Application Firewall rules to filter and block malicious HTTP requests containing strings like `class.module.classLoader`.
- **Downgrade:** Temporarily running the application on Java 8 mitigates the specific attack vector, though this is often impractical for modern environments.
## Detection
- **Indicators of Compromise:** Look for unexpected `.jsp` files in public-facing web directories (e.g., Tomcat's `webapps/ROOT/`).
- **Detection Methods:**
- Monitor server access logs for HTTP requests containing `class.module.classLoader`.
- Utilize vulnerability scanners and Managed XDR solutions with updated signatures (e.g., Group-IB Managed XDR signature released Mar 31, 2022).
- Review `RequestMapping` implementations for POJO binding.
## References
- **Spring Official Advisory:** hxxps[://]spring[.]io/blog/2022/03/31/spring-framework-rce-early-announcement
- **Vendor Analysis:** hxxps[://]www[.]group-ib[.]com/blog/spring4shell/