TTP Tuesday: Spring4Shell CVE-2022-22965

A remote code execution vulnerability was confirmed in the Spring Framework, the most popular Java framework used to build server-side apps.

CVE-2022-22965: Remote code execution in Spring Framework.

On March 31st, a researcher released a proof-of-concept (POC) attack that could remotely upload a web shell to a web server running Spring Framework, revealing a major new remote code execution vulnerability. This poses a significant danger to enterprises since a vulnerability like this might allow an attacker to seize control of the affected server.

Malicious scripts known as web shells allow threat actors to hijack web servers and execute further assaults. Threat actors can infiltrate a system or network before installing a web shell. They can utilize a web shell as a permanent backdoor into the compromised systems from this point forward.

Spring Framework versions prior to 5.3.18 are vulnerable to remote code execution.

Testing

Execute Operator’s CVE-2022-22965 TTP on each host running Spring Framework in your environment to test if you are vulnerable.

The TTP is configured to upload a webshell to the machine, run a command, and check for a specific output. If the output is successful then it'll delete the web shell completely, removing the web shell artifact from your system.

Remediation

Upgrade Spring Framework to version 5.3.18 or above. Spring has puboished a security advisory with instructions for patching and mitigating this vulnerability.

Staying up to date

Thanks for reading our latest TTP Tuesday release! Please subscribe and reach out with any feedback. We love to hear from our community!

There are several ways to follow us and learn more about Prelude and our team members:

Get our products

Download Prelude Operator: https://www.prelude.org/download/current
See the latest kill chain and TTP Releases: https://chains.prelude.org/
See our open-source repositories: https://github.com/preludeorg

Join our community

Discord: https://discord.gg/gzUv4XNquu
Reddit: https://www.reddit.com/r/preludeorg/
Twitter: https://twitter.com/preludeorg

Read, watch, and listen

Listen to our Podcast: https://anchor.fm/preludeorg
Read our blog: https://feed.prelude.org
Watch our live streams: https://www.twitch.tv/preludeorg
Watch our pre-recorded content: https://www.youtube.com/c/preludeorg

Follow our team

David: privateducky
Alex: khyberspache
Kris: Xanthonus
Octavia: VVX7
Bart: BartimusPrimed