CVE-2022-22965
About
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
Rainforest analyst review
Known as Spring4Shell, this abuses Spring's automatic data binding, the convenience feature that maps HTTP request parameters straight onto Java object fields. On JDK 9 and later an attacker can walk the object graph through that binding to reach the class loader, and by crafting parameter names that manipulate Tomcat's logging valve, write a chosen file, typically a JSP web shell, into a web-reachable directory. The classic path requires a Spring MVC or WebFlux app deployed as a traditional WAR on Tomcat, but the underlying binding weakness is general, so other exploitation routes exist beyond that one configuration.
Spring is the dominant Java web framework, so the exposed population is enormous and spans everything from bespoke enterprise apps to bundled products from Oracle, VMware, Siemens, and others that embed the framework. Public exploits and mass scanning appeared within days of disclosure, and botnet operators folded it into their toolkits quickly. Upgrading Spring Framework to the fixed 5.3.18 or 5.2.20 (and the JDK/Tomcat where relevant) is the real fix; the parameter-name mitigations floated early on are brittle. Prioritize internet-facing WAR deployments and audit for JSP web shells dropped before you patched.
References
- http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html
- http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005
- https://tanzu.vmware.com/security/cve-2022-22965
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.kb.cert.org/vuls/id/970766
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22965
Related CVEs
Frequently asked questions
What is CVE-2022-22965?
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit.
How severe is CVE-2022-22965?
CVE-2022-22965 carries a CVSS 3.1 base score of 9.8, rated critical. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 99 out of 100, in the critical band.
How is CVE-2022-22965 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): attack vector Network, attack complexity Low, privileges required None, user interaction None. Impact on confidentiality High, integrity High and availability High.
Which products are affected by CVE-2022-22965?
Public advisories list the following as affected: access appliance, commerce platform, communications cloud native core automated test suite, communications cloud native core binding support function, communications cloud native core console, communications cloud native core network exposure function, +33. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2022-22965?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.