Page 1 of 4 830

Spring4Shell Spring Framework Class Property Remote Code Execution
Posted May 10, 2022
Authored by vleminator | Site

Spring Framework versions 5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and older versions when running on JDK 9 or above and specifically packaged as a traditional WAR and deployed in a standalone Tomcat instance are vulnerable to remote code execution due to an unsafe data binding used to populate an object from request parameters to set a Tomcat specific ClassLoader. By crafting a request to the application and referencing the org.apache.catalina.valves.AccessLogValve class through the classLoader with parameters such as the following: class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp, an unauthenticated attacker can gain remote code execution.

tags | exploit, remote, code execution
advisories | CVE-2022-22965
SHA-256 |

Share your comment publicly