CVE-2022-22965

Description

Spring4Shell. A Spring MVC or Spring WebFlux application running on JDK 9 or later may be vulnerable to remote code execution through data binding. Request parameters bound to a controller argument (an @ModelAttribute parameter, or one with no other Spring Web annotation) could reach the class loader, and what an attacker can do from there depends on the servlet container. Affected: Spring Framework 5.3.0 to 5.3.17 and 5.2.19.RELEASE and earlier. Fixed in 5.3.18 and 5.2.20.RELEASE, released on 31 March 2022; Spring Boot 2.6.6 and 2.5.12 pull in the fix. Exploit conditions for the published exploit: JDK 9 or later, Apache Tomcat as the servlet container, the application packaged as a WAR, and a spring-webmvc or spring-webflux dependency. Spring's advisory says a Spring Boot executable jar, the default, is not vulnerable to that exploit, but that the flaw is more general and other paths may exist. Spring's early announcement also names Payara and GlassFish as known to be vulnerable. @RequestBody (JSON) parameters are not the entry point. Detection: check the resolved spring-beans or spring-webmvc version in every WAR and its build files, then the JDK version and servlet container the WAR runs on. CISA added the CVE to its Known Exploited Vulnerabilities catalog on 4 April 2022, so scanner hits on a running WAR should be treated as urgent. Mitigation: upgrade Spring Framework to 5.3.18 or 5.2.20 or later. Where that cannot happen quickly, Spring lists three stopgaps: Apache Tomcat 10.0.20, 9.0.62 or 8.5.78, which close the attack vector on Tomcat's side; running on Java 8; or a global @InitBinder that sets disallowedFields to class.*, Class.*, *.class.* and *.Class.*. Spring describes the Tomcat upgrade as tactical and notes the disallowedFields workaround can be overridden by a controller's own @InitBinder.

Upstream record: NVD · CVE.org