CVE-2022-22965
Spring Framework JDK 9+ Remote Code Execution Vulnerability
Description
CVE-2022-22965, widely known as "Spring4Shell," is a remote code execution vulnerability in the VMware Spring Framework that allows attackers to execute arbitrary code on affected systems through the data binding mechanism. The vulnerability affects Spring MVC and Spring WebFlux applications running on JDK 9 or higher. It was added to CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 97.4% (99.9th percentile), Spring4Shell represents one of the most critical web application vulnerabilities disclosed in 2022.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| vmware | spring framework | < 5.2.20; >= 5.3.0, < 5.3.18 |
| cisco | cx cloud agent | < 2.1.0 |
| oracle | communications cloud native core automated test suite | 1.9.0; 22.1.0 |
| oracle | communications cloud native core console | 1.9.0; 22.1.0 |
| oracle | communications cloud native core network exposure function | 22.1.0 |
| oracle | communications cloud native core network function cloud native environment | 1.10.0; 22.1.0 |
| oracle | communications cloud native core network repository function | 1.15.0; 22.1.0 |
| oracle | communications cloud native core network slice selection function | 1.8.0; 1.15.0; 22.1.0 |
| oracle | communications cloud native core policy | 1.15.0; 22.1.0 |
| oracle | communications cloud native core security edge protection proxy | 1.7.0; 22.1.0 |
| oracle | communications cloud native core unified data repository | 1.15.0; 22.1.0 |
| oracle | communications policy management | 12.6.0.0.0 |
| oracle | financial services analytical applications infrastructure | 8.1.1; 8.1.2.0 |
| oracle | financial services behavior detection platform | 8.1.1.0; 8.1.1.1; 8.1.2.0 |
| oracle | financial services enterprise case management | 8.1.1.0; 8.1.1.1; 8.1.2.0 |
| oracle | mysql enterprise monitor | < 8.0.29 |
| oracle | product lifecycle analytics | 3.6.1 |
| oracle | retail xstore point of service | 20.0.1; 21.0.0 |
| oracle | sd-wan edge | 9.0; 9.1 |
| siemens | operation scheduler | < 2.0.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html(Third Party Advisory, VDB Entry)
- https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf(Patch, Third Party Advisory)
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005(Third Party Advisory)
- https://tanzu.vmware.com/security/cve-2022-22965(Mitigation, Vendor Advisory)
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67(Third Party Advisory)
- https://www.oracle.com/security-alerts/cpuapr2022.html(Third Party Advisory)
- https://www.oracle.com/security-alerts/cpujul2022.html(Patch, Third Party Advisory)
- https://www.kb.cert.org/vuls/id/970766(US Government Resource)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22965(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
Code injection occurs when an application constructs code using unsanitized input, allowing attackers to inject and execute arbitrary code within the application context. In CVE-2022-22965, the Spring Framework's data binding mechanism can be exploited to modify server-side objects through crafted HTTP requests, ultimately leading to code execution. For more details, see CWE-94.
Impact Analysis
Successful exploitation of Spring4Shell allows remote, unauthenticated attackers to achieve full remote code execution on affected application servers. This can lead to complete server compromise, data theft, deployment of web shells for persistent access, and lateral movement within the organization's network. The Spring Framework is one of the most widely used Java frameworks in enterprise environments, meaning the potential attack surface spans millions of applications across industries. Organizations running Spring-based applications on JDK 9+ with specific deployment configurations face immediate risk of compromise without patching.
Exploit Maturity
CVE-2022-22965 was rapidly weaponized after disclosure in March 2022 and was added to CISA's KEV catalog on April 4, 2022. The EPSS score of 97.4% (99.9th percentile) reflects extremely widespread exploitation activity. Multiple proof-of-concept exploits were released within days of disclosure, and automated exploitation tools quickly followed. Threat actors including botnet operators and cryptocurrency miners rapidly integrated the exploit into their campaigns. The simplicity of exploitation through crafted HTTP requests makes it accessible to attackers of all skill levels.
Remediation
- Update the Spring Framework to version 5.3.18 or 5.2.20 or later, and Spring Boot to version 2.6.6 or 2.5.12 or later, as required by CISA's KEV catalog.
- If immediate patching is not possible, implement the recommended workaround by setting disallowedFields on WebDataBinder to block the class.module property access path.
- Upgrade to JDK 8 as a temporary mitigation if upgrading Spring is not immediately feasible, as the vulnerability requires JDK 9+.
- Deploy web application firewall rules to detect and block exploitation attempts targeting Spring data binding patterns.
- Audit application servers for indicators of compromise including unauthorized web shell files, unexpected outbound connections, and suspicious process executions.
Technical Details
The vulnerability exploits the Spring Framework's data binding mechanism, which automatically maps HTTP request parameters to Java object properties. On JDK 9 and higher, the Module API introduced a new access path via the class.module.classLoader chain that was not blocked by Spring's existing safeguards. An attacker can send specially crafted HTTP requests that traverse this property chain to modify internal Tomcat logging properties, specifically changing the log pattern to inject JSP code and the log directory to a web-accessible location. This effectively creates a web shell on the server without requiring file upload capabilities. The attack is particularly effective against Spring MVC applications deployed as WAR files on Apache Tomcat.
Frequently Asked Questions
What is CVE-2022-22965 (Spring4Shell)?
CVE-2022-22965, nicknamed "Spring4Shell," is a remote code execution vulnerability in the VMware Spring Framework. It exploits the data binding mechanism to allow unauthenticated attackers to execute arbitrary code on affected servers. The name draws parallels to the Log4Shell vulnerability that preceded it.
What are the prerequisites for exploitation?
The vulnerability requires: Spring Framework 5.3.0 to 5.3.17 or 5.2.0 to 5.2.19, JDK 9 or higher, and typically Apache Tomcat as the application server with the application deployed as a WAR file. Applications using Spring Boot's embedded Tomcat with JAR packaging have additional configuration requirements for exploitation.
Is this as severe as Log4Shell?
While Spring4Shell is a critical vulnerability, its impact is generally considered narrower than Log4Shell because it requires a more specific set of conditions for exploitation. Log4Shell affected virtually any Java application using Log4j, whereas Spring4Shell requires specific Spring, JDK, and deployment configurations.
How can I detect exploitation attempts?
Monitor web server access logs for HTTP requests containing parameter names like class.module.classLoader that attempt to traverse the Java object property chain. WAF and IDS signatures for Spring4Shell are available from major security vendors.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.