Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

CVE-2022-22965: Spring Core Remote Code Execution Vulnerability Exploited In the Wild (Spring Shell) (Updated)

Summary: Spring released versions 5.3.18 and 5.2.20 of Spring Framework on March 31, 2022 to patch CVE-2022-22965, an unauthenticated remote code execution flaw with a CVSS score of 9.8 that Unit 42 observed being exploited in the wild. The flaw stems from the getCachedIntrospectionResults method exposing a class object during parameter binding, which public proofs of concept use to alter Tomcat log configuration and write a JSP webshell such as shell7.jsp into the ROOT directory. Unit 42's threat prevention signature triggered 43,092 times in the seven days after its March 31 release, with 2,056 unique source IP addresses and 95 unique webshell filenames observed.

Key Takeaway: The top 15 source IP addresses accounted for just over 50% of the 43,092 signature hits, and the tomcatwar.jsp filename from the original PoC appeared in over 57% of observed filenames - meaning most of this activity is commodity scanning against a flaw that grants unauthenticated remote code execution on any Java application using spring-beans and parameter binding.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Vulnerabilities & Patching
Mentions
CVE-2022-22963CVE-2022-22965
Related