Spring4Shell
- Product
- VMware / Spring Spring Framework (spring-beans / spring-webmvc)
- CVE
- CVE-2022-22965
- Disclosed
- 2022-03-31
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- Spring Framework 5.3.0-5.3.17, 5.2.0-5.2.19 and older unsupported versions, on JDK 9+; known exploit path needs a WAR deployment on Apache Tomcat
- Fixed
- Spring Framework 5.3.18 / 5.2.20 (Spring Boot 2.6.6 / 2.5.12); Tomcat 10.0.20, 9.0.62, 8.5.78 also block the known path
Summary
Spring MVC's data binding let request parameters set nested properties on the bound object, including properties reachable through its class and class loader. On JDK 9+ this re-opened an old 2010 bug class and let attackers reconfigure Tomcat's access log to write a JSP web shell. It leaked as a zero-day days before the patch.
Root cause
Spring blocked class.classLoader in data binding after CVE-2010-1622, but JDK 9 added Class.getModule(), so class.module.classLoader bypassed the block. On Tomcat the web app class loader exposes resources.context.parent.pipeline.first, i.e. the AccessLogValve, whose pattern, directory, prefix and suffix properties can be set from request parameters, turning the access log into an attacker-written .jsp file.
Impact
Unauthenticated RCE (web shell) on Spring MVC / WebFlux apps that bind request parameters to POJOs and run as WARs on Tomcat with JDK 9+.
Public PoC
# Parameter names used to rewrite Tomcat's AccessLogValve (values omitted):
class.module.classLoader.resources.context.parent.pipeline.first.pattern=...
class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp
class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT
class.module.classLoader.resources.context.parent.pipeline.first.prefix=shell
class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat=Source: reznok / Spring4Shell-POC
Detection
Look for request parameters containing class.module.classLoader in access/WAF logs and for new .jsp files under webapps/ROOT. Check spring-beans version and JDK. Nuclei template CVE-2022-22965.
Mitigation
Upgrade Spring Framework (or Spring Boot) and Tomcat; as a stopgap set disallowedFields for class.*, Class.*, *.class.*, *.Class.* on WebDataBinder.