Advisory details:
github_osv / GHSA-36p3-wjmg-h94x
| Advisory ID | github_osv/GHSA-36p3-wjmg-h94x |
| Aliases |
CVE-2022-22965
|
| Summary | Remote Code Execution in Spring Framework Spring Framework prior to versions 5.2.20 and 5.3.18 contains a remote code execution vulnerability known as `Spring4Shell`. ## Impact A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it. These are the prerequisites for the exploit: - JDK 9 or higher - Apache Tomcat as the Servlet container - Packaged as WAR - `spring-webmvc` or `spring-webflux` dependency ## Patches - Spring Framework [5.3.18](https://github.com/spring-projects/spring-framework/releases/tag/v5.3.18) and [5.2.20](https://github.com/spring-projects/spring-framework/releases/tag/v5.2.20.RELEASE) - Spring Boot [2.6.6](https://github.com/spring-projects/spring-boot/releases/tag/v2.6.6) and [2.5.12](https://github.com/spring-projects/spring-boot/releases/tag/v2.5.12) ## Workarounds For those who are unable to upgrade, leaked reports recommend setting `disallowedFields` on `WebDataBinder` through an `@ControllerAdvice`. This works generally, but as a centrally applied workaround fix, may leave some loopholes, in particular if a controller sets `disallowedFields` locally through its own `@InitBinder` method, which overrides the global setting. To apply the workaround in a more fail-safe way, applications could extend `RequestMappingHandlerAdapter` to update the `WebDataBinder` at the end after all other initialization. In order to do that, a Spring Boot application can declare a `WebMvcRegistrations` bean (Spring MVC) or a `WebFluxRegistrations` bean (Spring WebFlux). |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 8.8 |
| Risk | 10.0 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 9.8 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-36p3-wjmg-h94x/GHSA-36p3-wjmg-h94x.json |
| generic_textual | CRITICAL |
| Data source | Metasploit |
|---|---|
| Description | Spring Framework versions 5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and older versions when running on JDK 9 or above and specifically packaged as a traditional WAR and deployed in a standalone Tomcat instance are vulnerable to remote code execution due to an unsafe data binding used to populate an object from request parameters to set a Tomcat specific ClassLoader. By crafting a request to the application and referencing the org.apache.catalina.valves.AccessLogValve class through the classLoader with parameters such as the following: class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp, an unauthenticated attacker can gain remote code execution. |
| Note | AKA: - Spring4Shell - SpringShell Stability: - crash-safe Reliability: - repeatable-session SideEffects: - ioc-in-logs - artifacts-on-disk |
| Ransomware campaign use | Unknown |
| Source publication date | March 31, 2022 |
| Platform | Linux,Windows |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/spring_framework_rce_spring4shell.rb |
| Data source | KEV |
|---|---|
| Date added | April 4, 2022 |
| Description | Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. |
| Required action | Apply updates per vendor instructions. |
| Due date | April 25, 2022 |
| Note | https://nvd.nist.gov/vuln/detail/CVE-2022-22965 |
| Ransomware campaign use | Unknown |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-01-29T17:52:10Z/
Decision: Act
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2022/22xxx/CVE-2022-22965.json
Source Advisory: vulnrichment/CVE-2022-22965
[{'Exploitation': 'active'},
{'Automatable': 'yes'},
{'Technical Impact': 'total'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]