Full Report
A vulnerability in Spring Framework was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2022-22965 and is also known as “Spring4Shell” or “SpringShell”. Siemens is currently investigating to determine which products are affected and is continuously updating this advisory as more information becomes available. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not, or not yet available.
Analysis Summary
# Vulnerability: Spring4Shell Remote Code Execution in Spring Framework
## CVE Details
- **CVE ID:** CVE-2022-22965
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-94 (Improper Control of Generation of Code)
## Affected Systems
- **Products:** Siemens products utilizing the Spring Framework (investigation ongoing).
- **Versions:** Spring Framework versions 5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and older unsupported versions.
- **Configurations:** Typically requires the application to run on Java Development Kit (JDK) 9 or higher, using Apache Tomcat as the Servlet container, packaged as a traditional WAR (Web Application Archive), and utilizing the `spring-webmvc` or `spring-webflux` dependency.
## Vulnerability Description
The vulnerability is a bypass of the patch for CVE-2010-1622. It occurs due to how Spring handles parameter binding. An attacker can exploit the `SerializationUtils` and the class loader to override specific Tomcat logging properties. By sending a specially crafted HTTP request, an attacker can manipulate the `AccessLogValve` properties to create a JSP webshell in the web root, leading to arbitrary Remote Code Execution (RCE).
## Exploitation
- **Status:** Exploited in the wild | Public PoC available.
- **Complexity:** Low.
- **Attack Vector:** Network (Remote, unauthenticated).
## Impact
- **Confidentiality:** Total (High).
- **Integrity:** Total (High).
- **Availability:** Total (High).
## Remediation
### Patches
- **Spring Framework:** Upgrade to versions **5.3.18+** or **5.2.20+**.
- **Spring Boot:** Upgrade to versions **2.6.6+** or **2.5.12+**.
- **Siemens Products:** Siemens has released updates for several affected products. Users should monitor the official Siemens advisory for specific product version updates as they become available.
### Workarounds
- **Downgrade JDK:** Reverting to JDK 8 can mitigate the primary exploitation path.
- **Disallow Fields:** Implement a `WebDataBinder` to disallow specific patterns (e.g., `{"class.*", "Class.*", "*.class.*", "*.Class.*"}`).
- **WAF Rules:** Deploy Web Application Firewall rules to filter for strings like `class.module.classLoader` in HTTP requests.
## Detection
- **Indicators of Compromise:** Unusual `.jsp` files in the Tomcat `webapps` directory; presence of unexpected log files or modified logging configurations.
- **Detection Methods:** Vulnerability scanners (Tenable, Qualys) have updated plugins for Spring4Shell. YARA rules are available to detect common webshells dropped by this exploit.
## References
- **Siemens Advisory:** hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-313488[.]pdf
- **Spring Official Blog:** hxxps[://]spring[.]io/blog/2022/03/31/spring-framework-rce-early-announcement
- **NVD Entry:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2022-22965