## https://sploitus.com/exploit?id=0F31CD42-C35C-5E71-870A-EE9FD33CEA85
# π¨ CVE-2022-22965 - "Spring4Shell"
> Critical Remote Code Execution (RCE) vulnerability in the **:contentReference[oaicite:0]{index=0}**
> Publicly disclosed: **March 31, 2022**
---
# π Table of Contents
- Overview
- Affected Components
- Technical Root Cause
- Exploitation Conditions
- Impact
- Severity & CVSS
- Mitigation & Patching
- Timeline
- Comparison with Log4Shell
- Summary
---
# π Overview
**Spring4Shell** is the nickname for **CVE-2022-22965**, a vulnerability in Springβs data binding mechanism that could allow attackers to achieve **Remote Code Execution (RCE)**.
It primarily affected applications using:
- **:contentReference[oaicite:1]{index=1}**
- Packaged as a WAR file
- Deployed on **:contentReference[oaicite:2]{index=2}**
- Running on **:contentReference[oaicite:3]{index=3} 9 or later**
---
# π§ Technical Root Cause
Spring MVC automatically maps HTTP request parameters to Java object fields β a process called **data binding**.
Under certain conditions, attackers could:
1. Manipulate object properties through crafted HTTP parameters
2. Access internal class loader properties
3. Modify Tomcat configuration
4. Write a malicious JSP file (web shell) to disk
This ultimately allowed arbitrary code execution on the server.
---
# βοΈ Exploitation Conditions
Spring4Shell was **not universally exploitable**. All of the following had to be true:
- β Running Java 9+
- β Using vulnerable Spring versions (5.3.0β5.3.17 or 5.2.0β5.2.19)
- β Deployed as a WAR file
- β Running on Apache Tomcat
- β Data binding enabled for request parameters
If packaged as a **Spring Boot executable JAR**, exploitation was typically not possible.
---
# π₯ Potential Impact
If successfully exploited, an attacker could:
- Upload a web shell (JSP)
- Execute arbitrary system commands
- Access sensitive application data
- Pivot deeper into internal networks
- Fully compromise the application server
---
# π Severity & CVSS
| Metric | Value |
|--------|--------|
| CVE ID | CVE-2022-22965 |
| CVSS Score | 9.8 (Critical) |
| Attack Vector | Network |
| Authentication Required | β No |
| User Interaction | β None |
| Impact | Full RCE |
---
# π Mitigation & Patching
## β Official Fix
Upgrade to:
- Spring Framework **5.3.18**
- Spring Framework **5.2.20**
Spring Boot versions were also updated accordingly.
---
## π Recommended Hardening
- Prefer JAR packaging over WAR
- Upgrade Java runtime
- Restrict writable directories
- Disable unnecessary binding fields
- Monitor for suspicious file creation
- Deploy Web Application Firewall (WAF)
---
# π Timeline
| Date | Event |
|------|--------|
| March 2022 | Vulnerability reported |
| March 31, 2022 | Public disclosure |
| Same day | Patch released |
| Following days | Security scanning begins globally |
---
# π₯ Spring4Shell vs Log4Shell
| Feature | Spring4Shell | Log4Shell |
|----------|--------------|-----------|
| Framework | Spring Framework | Apache Log4j |
| CVE | 2022-22965 | 2021-44228 |
| Exploit Complexity | Moderate (requires conditions) | Extremely Low |
| Default Exposure | Limited | Widespread |
| CVSS | 9.8 | 10.0 |
Spring4Shell was serious, but **Log4Shell had broader real-world exposure**.
---
# π Summary
| Field | Value |
|-------|--------|
| Name | Spring4Shell |
| CVE | CVE-2022-22965 |
| Type | Remote Code Execution |
| Affected Software | Spring Framework |
| Severity | Critical |
| Patch Available | Yes |
| Exploit Conditions | Specific configuration required |
---
# β οΈ Final Notes
Spring4Shell demonstrated how complex object binding and reflection in modern frameworks can introduce unexpected attack surfaces.
While not as globally impactful as Log4Shell, it remains a critical vulnerability that required immediate patching in affected environments.