Code Injection in Spring Framework - CVE-2022-22965

Vulnerability identifier: #VU61756

CSH Severity: Critical

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-22965

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation. A remote attacker can send a specially crafted HTTP request to the affected application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

This vulnerability was dubbed "Spring4Shell".

Spring Framework
xxl-job
IBM i Modernization Engine for Lifecycle Integration
vRO Plug-in for Dell EMC PowerScale
vRO Plug-in for Dell EMC Unity
vRO Plug-in for Dell EMC PowerStore
vRO Plug-in for Dell EMC PowerMax
vRO Plug-in for Dell EMC XtremIO
Dell Policy Manager for Secure Connect Gateway (SCG)
Oracle Financial Services Analytical Applications Infrastructure
Terracotta
Oracle Data Integrator
Oracle Communications Policy Management
Oracle Retail Xstore Point of Service
IBM Planning Analytics Workspace
Dell Wyse Management Suite
IBM Engineering Requirements Management DOORS Next
Oracle Insurance Policy Administration Operational Data Store for Life and Annuity
IBM Db2 Web Query for i
Oracle Managed File Transfer
Oracle Retail Bulk Data Integration
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Oracle Communications Cloud Native Core Network Slice Selection Function
Oracle Communications Cloud Native Core Console
Oracle Communications Cloud Native Core Network Function Cloud Native Environment
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Unified Data Repository
Oracle Communications Cloud Native Core Automated Test Suite
VMware Tanzu Kubernetes Grid Integrated Edition
Oracle Communications Cloud Native Core Network Repository Function
VMware Tanzu Application Service for VMs
IBM Spectrum Conductor
Red Hat Advanced Cluster Security for Kubernetes
Oracle Product Lifecycle Analytics
IBM Edge Application Manger
IBM Sterling B2B Integrator
FortiSOAR
IBM Tivoli Netcool Impact
IBM Spectrum Symphony
Oracle Communications Unified Inventory Management
IBM Maximo for Civil Infrastructure
IBM SPSS Collaboration and Deployment Services
Oracle Financial Services Behavior Detection Platform
Oracle Financial Services Enterprise Case Management
IBM Common Licensing
Oracle SD-WAN Edge
Rational Test Workbench
Rational Test Virtualization Server
Oracle Communications Cloud Native Core Network Exposure Function
Oracle Communications Cloud Native Core Binding Support Function
Autodesk Infraworks
IBM Process Mining
IBM MaaS360 Mobile Enterprise Gateway
IBM MaaS360 Cloud Extender Agent
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Sterling Connect:Direct Web Services
IBM Sterling Control Center
IBM Sterling Connect:Direct for UNIX
IBM Tivoli Monitoring
IBM Robotic Process Automation with Automation Anywhere
IBM Cloud Pak for Business Automation
IBM Cloud Pak System
VMware Tanzu Operations Manager
Bosh Release for the UAA
AMQ Broker
Oracle WebLogic Server
Fuse
MySQL Enterprise Monitor
Zimbra Collaboration
IBM Cognos Command Center
IBM Cognos Controller
Oracle Commerce Guided Search
Oracle Commerce Platform
Oracle Retail Financial Integration
Oracle Retail Merchandising System
Oracle Retail Customer Management and Segmentation Foundation
Oracle Retail Integration Bus
Ubuntu
Cloud Foundry UAA
libspring-oxm-java (Ubuntu package)
libspring-web-java (Ubuntu package)
libspring-core-java (Ubuntu package)
libspring-context-support-java (Ubuntu package)
libspring-expression-java (Ubuntu package)
libspring-web-portlet-java (Ubuntu package)
libspring-transaction-java (Ubuntu package)
libspring-context-java (Ubuntu package)
libspring-web-servlet-java (Ubuntu package)
libspring-beans-java (Ubuntu package)
libspring-orm-java (Ubuntu package)
libspring-aop-java (Ubuntu package)
libspring-messaging-java (Ubuntu package)
libspring-jdbc-java (Ubuntu package)
libspring-jms-java (Ubuntu package)
libspring-instrument-java (Ubuntu package)
watsonx.data
Library Support for Spring
IBM MaaS360 VPN Module
Dell EMC AppSync
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
Dell EMC VxRail Appliance
IBM DS8000 Hardware Management Console

Install update from vendor's website.

Spring Framework - addressed in versions 5.2.20, 5.3.18
IBM i Modernization Engine for Lifecycle Integration - update to 1.0.1
vRO Plug-in for Dell EMC PowerScale - addressed in versions 1.0.5, 1.1.3
vRO Plug-in for Dell EMC Unity - update to 1.0.9
vRO Plug-in for Dell EMC PowerStore - update to 1.1.6
vRO Plug-in for Dell EMC PowerMax - update to 1.2.6
xxl-job - update to 2.3.1
IBM Cloud Pak System - update to 2.3.3.4
VMware Tanzu Application Service for VMs - addressed in versions 2.10.29, 2.11.17, 2.12.10, 2.13.1
VMware Tanzu Operations Manager - addressed in versions 2.8.20, 2.9.35, 2.10.35
Red Hat Advanced Cluster Security for Kubernetes - update to 3.70
vRO Plug-in for Dell EMC XtremIO - update to 4.1.4
Dell Policy Manager for Secure Connect Gateway (SCG) - update to 5.12.00.00
FortiSOAR - update to 7.2.0
IBM Tivoli Netcool Impact - update to 7.1.0.26
IBM Maximo for Civil Infrastructure - update to 7.6.3.2
AMQ Broker - addressed in versions 7.8.6, 7.9.4
Zimbra Collaboration - addressed in versions 8.8.15 Patch 31, 9.0.0 Patch 24
IBM Cognos Command Center - update to 10.2.4 Fix Pack 1 IF15
Terracotta - update to 11.1.0
Cloud Foundry UAA - update to 75.18.0
Bosh Release for the UAA - update to 75.18.0
Autodesk Infraworks - addressed in versions 2021.2 Hotfix 9, 2023.1 Hotfix 1
libspring-oxm-java (Ubuntu package) - addressed in versions Ubuntu Pro, 4.3.30-2ubuntu0.24.10.1
libspring-web-java (Ubuntu package) - addressed in versions Ubuntu Pro, 4.3.30-2ubuntu0.24.10.1
libspring-core-java (Ubuntu package) - addressed in versions Ubuntu Pro, 4.3.30-2ubuntu0.24.10.1
libspring-context-support-java (Ubuntu package) - addressed in versions Ubuntu Pro, 4.3.30-2ubuntu0.24.10.1
libspring-expression-java (Ubuntu package) - addressed in versions Ubuntu Pro, 4.3.30-2ubuntu0.24.10.1
libspring-web-portlet-java (Ubuntu package) - addressed in versions Ubuntu Pro, 4.3.30-2ubuntu0.24.10.1
libspring-transaction-java (Ubuntu package) - addressed in versions Ubuntu Pro, 4.3.30-2ubuntu0.24.10.1
libspring-context-java (Ubuntu package) - addressed in versions Ubuntu Pro, 4.3.30-2ubuntu0.24.10.1
libspring-web-servlet-java (Ubuntu package) - addressed in versions Ubuntu Pro, 4.3.30-2ubuntu0.24.10.1
libspring-beans-java (Ubuntu package) - addressed in versions Ubuntu Pro, 4.3.30-2ubuntu0.24.10.1
libspring-orm-java (Ubuntu package) - addressed in versions Ubuntu Pro, 4.3.30-2ubuntu0.24.10.1
libspring-aop-java (Ubuntu package) - addressed in versions Ubuntu Pro, 4.3.30-2ubuntu0.24.10.1
libspring-messaging-java (Ubuntu package) - addressed in versions Ubuntu Pro, 4.3.30-2ubuntu0.24.10.1
libspring-jdbc-java (Ubuntu package) - addressed in versions Ubuntu Pro, 4.3.30-2ubuntu0.24.10.1
libspring-jms-java (Ubuntu package) - addressed in versions Ubuntu Pro, 4.3.30-2ubuntu0.24.10.1
libspring-instrument-java (Ubuntu package) - addressed in versions Ubuntu Pro, 4.3.30-2ubuntu0.24.10.1
IBM Process Mining - update to 1.12.0.5
watsonx.data - update to 2.0.2
IBM Planning Analytics Workspace - update to 2.0.76
Library Support for Spring - update to 2.7.29
IBM MaaS360 Mobile Enterprise Gateway - update to 2.106.500
IBM MaaS360 VPN Module - update to 2.106.500
IBM MaaS360 Cloud Extender Agent - update to 2.106.500.011
Dell Wyse Management Suite - update to 3.6.1
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.0.7
Dell EMC AppSync - update to 4.4.0.0
Dell EMC VxRail Appliance - update to 4.5.480
IBM Sterling Connect:Direct Web Services - addressed in versions 6.0.0.8, 6.1.0.12, 6.2.0.6
IBM Sterling Control Center - addressed in versions 6.2.0.0.17, 6.2.1.0.7
IBM Sterling Connect:Direct for UNIX - update to 6.2.0.3.13
IBM Tivoli Monitoring - update to 6.3.0.7 Service Pack 12
Fuse - update to 7.10.2
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.12.1
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.7
IBM Cognos Controller - addressed in versions 10.4.1.0.15, 10.4.2.0.2
IBM Robotic Process Automation with Automation Anywhere - update to 19.0.0.10
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.12, 22.0.1.2
IBM DS8000 Hardware Management Console - update to 89.30.68.0

• Exploit #8761 - CVE-2022-22965 (? Exploit for SpringShell.) (January 22, 2023)
• Exploit #8310 - CVE-2022-22965 (? Exploit for SpringShell.) (August 29, 2022)
• Exploit #8247 - CVE-2022-22965-POC (CVE-2022-22965 spring-core批量检测脚本) (August 14, 2022)
• Exploit #8202 - CVE-2022-22965 (Exploit for SpringShell.) (August 1, 2022)
• Exploit #8099 - CVE-2022-22965 (spring4shell | CVE-2022-22965) (June 30, 2022)
• Exploit #7975 - CVE-2022-22965-POC (CVE-2022-22965 spring-core批量检测脚本) (June 6, 2022)
• Exploit #7775 - Spring Framework Class property RCE (Spring4Shell) (May 12, 2022)
• Exploit #7713 - spring-RCE-CVE-2022-22965 () (May 2, 2022)
• Exploit #7645 - -Spring4Shell-CVE-2022-22965- (exploitation script tryhackme ) (April 14, 2022)
• Exploit #7636 - CVE-2022-22965 (spring4shell | CVE-2022-22965) (April 13, 2022)
• Exploit #7626 - CVE-2022-22965 (Spring4Shell (CVE-2022-22965)) (April 11, 2022)
• Exploit #7623 - CVE-2022-22965-PoC_Payara () (April 11, 2022)
• Exploit #7622 - Spring4Shell-CVE-2022-22965.py (Script to check for Spring4Shell vulnerability) (April 11, 2022)
• Exploit #7618 - CVE-2022-22965_PoC (Spring Framework RCE (Quick pentest notes)) (April 7, 2022)
• Exploit #7617 - springboot_CVE-2022-22965 (CVE-2022-22965 pocsuite3 POC) (April 7, 2022)
• Exploit #7614 - spring-core-rce (springFramework_CVE-2022-22965_RCE简单利用) (April 7, 2022)
• Exploit #7613 - Spring4ShellPoC (Spring4Shell PoC (CVE-2022-22965)) (April 7, 2022)
• Exploit #7612 - spring4shell_behinder (CVE-2022-22965写入冰蝎webshell脚本) (April 7, 2022)
• Exploit #7609 - irule-cve-2022-22965 () (April 6, 2022)
• Exploit #7606 - CVE-2022-22965 (Spring4Shell is a critical RCE vulnerability in the Java Spring Framework and is one of three related vulnerabilities published on March 30) (April 5, 2022)
• Exploit #7605 - CVE-2022-22965 (Spring Framework RCE Exploit) (April 5, 2022)
• Exploit #7600 - CVE-2022-22965 (Exploit Of Spring4Shell!) (April 5, 2022)
• Exploit #7598 - nmap-spring4shell (Nmap Spring4Shell NSE script for Spring Boot RCE (CVE-2022-22965) ) (April 5, 2022)
• Exploit #7597 - CVE-2022-22965 (Spring Framework RCE via Data Binding on JDK 9+ / spring4shell / CVE-2022-22965) (April 5, 2022)
• Exploit #7595 - CVE-2022-22965-PoC (CVE-2022-22965 (Spring4Shell) Proof of Concept) (April 5, 2022)
• Exploit #7594 - springshell-vuln-POC (POC to prove springshell CVE 2022-22965) (April 5, 2022)
• Exploit #7593 - Spring4shell-CVE-2022-22965-POC (Another spring4shell (Spring core RCE) POC) (April 5, 2022)
• Exploit #7592 - go-scan-spring (Vulnerability scanner for Spring4Shell (CVE-2022-22965)) (April 5, 2022)
• Exploit #7590 - spring-core-rce (spring框架RCE漏洞 CVE-2022-22965) (April 3, 2022)
• Exploit #7589 - CVE-2022-22965 (CVE-2022-22965 POC) (April 3, 2022)
• Exploit #7588 - spring-framework-rce (CVE-2022-22965) (April 3, 2022)
• Exploit #7587 - cve-2022-22965 () (April 3, 2022)
• Exploit #7582 - CVE-2022-22965_Spring_Core_RCE (CVE-2022-22965\Spring-Core-RCE堪比关于 Apache Log4j2核弹级别漏洞exp的rce一键利用) (April 3, 2022)
• Exploit #7581 - SpringFramework_CVE-2022-22965_RCE (SpringFramework 远程代码执行漏洞CVE-2022-22965) (April 3, 2022)
• Exploit #7579 - CVE-2022-22965-Spring-CachedintrospectionResults-Rce (批量无损检测) (April 3, 2022)
• Exploit #7576 - spring4shell-exploit-poc (Exploit a vulnerable Spring application with the Spring4Shell (CVE-2022-22965) Vulnerability.) (April 3, 2022)
• Exploit #7575 - CVE-2022-22965 (Docker PoC for CVE-2022-22965 with Spring Boot version 2.6.5) (April 3, 2022)
• Exploit #7569 - CVE-2022-22965 (Vulnerabilidad RCE en Spring Framework vía Data Binding on JDK 9+ (CVE-2022-22965 aka "Spring4Shell")) (March 31, 2022)
• Exploit #7568 - CVE-2022-22965-poc (CVE-2022-22965 poc including reverse-shell support) (March 31, 2022)
• Exploit #7567 - Spring-CVE (This includes CVE-2022-22963, a Spring SpEL / Expression Resource Access Vulnerability, as well as CVE-2022-22965, the spring-webmvc/spring-webflux RCE termed "SpringShell".) (March 31, 2022)
• Exploit #7565 - Spring4Shell-POC (Dockerized Spring4Shell (CVE-2022-22965) PoC application and exploit) (March 31, 2022)
• Exploit #7563 - CVE-2022-22965 (Spring Framework RCE (CVE-2022-22965) Nmap (NSE) Checker (Non-Intrusive)) (March 31, 2022)
• Exploit #7562 - Safer_PoC_CVE-2022-22965 (A Safer PoC for CVE-2022-22965 (Spring4Shell)) (March 31, 2022)
• Exploit #7560 - Spring4Shell-POC (Spring4Shell Proof Of Concept/And vulnerable application CVE-2022-22965) (March 31, 2022)

• https://lab.wallarm.com/update-on-0-day-vulnerabilities-in-spring-spring4shell-and-cve-2022-22963/
• https://tanzu.vmware.com/security/cve-2022-22965
• https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement

• Remote code execution in Spring Framework
• UAA update for Spring Framework
• UAA update for Spring Framework
• Remote code execution in VMware Tanzu Application Service for VMs
• Remote code execution in VMware Tanzu Operations Manager
• Remote code execution in VMware Tanzu Kubernetes Grid Integrated Edition
• Remote code execution in IBM Sterling B2B Integrator
• Remote code execution in IBM Maximo for Civil Infrastructure
• Remote code execution in Red Hat Process Automation Manager
• Multiple vulnerabilities in MySQL Enterprise Monitor
• Cloud Foundry UAA update for Spring Framework
• Code Injection in Oracle SD-WAN Edge
• Multiple vulnerabilities in Oracle Communications Policy Management
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Unified Data Repository
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Security Edge Protection Proxy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Repository Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Function Cloud Native Environment
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Console
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Automated Test Suite
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Slice Selection Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Exposure Function
• Multiple vulnerabilities in Oracle Financial Services Enterprise Case Management
• Multiple vulnerabilities in Oracle Financial Services Behavior Detection Platform
• Multiple vulnerabilities in Oracle Financial Services Analytical Applications Infrastructure
• Code Injection in Oracle Product Lifecycle Analytics
• Multiple vulnerabilities in Oracle Retail Xstore Point of Service
• Remote code execution in Red Hat AMQ Broker 7.8
• Remote code execution in Red Hat AMQ Broker 7.9
• Multiple vulnerabilities in xxl-job
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes
• Remote code execution in IBM Edge Application Manager
• Multiple vulnerabilities in IBM SPSS Collaboration and Deployment Services
• Code Injection in IBM Common Licensing
• Multiple vulnerabilities in IBM MaaS360 Cloud Extender Agent, Mobile Enterprise Gateway and VPN Module
• Code Injection in IBM Cognos Command Center
• Code Injection in IBM Sterling Connect:Direct Web Services
• Multiple vulnerabilities in IBM DS8000 Hardware Management Console
• Multiple vulnerabilities in IBM Db2 Web Query for i
• Code Injection in Rational Test Virtualization Server and Rational Test Workbench
• Code Injection in IBM Spectrum Conductor
• Code Injection in IBM Spectrum Symphony
• Code Injection in IBM Tivoli Netcool Impact
• Multiple vulnerabilities in IBM i Modernization Engine for Lifecycle Integration
• Multiple vulnerabilities in Oracle Commerce Platform
• Multiple vulnerabilities in Oracle Communications Unified Inventory Management
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Binding Support Function
• Multiple vulnerabilities in Oracle WebLogic Server
• Multiple vulnerabilities in Oracle Retail Merchandising System
• Code Injection in Oracle Retail Integration Bus
• Code Injection in Oracle Retail Financial Integration
• Code Injection in Oracle Retail Customer Management and Segmentation Foundation
• Code Injection in Oracle Retail Bulk Data Integration
• Multiple vulnerabilities in Dell Policy Manager for Secure Connect Gateway
• Multiple vulnerabilities in Zimbra Collaboration
• Multiple vulnerabilities in IBM Cloud Pak System
• Remote code execution in Dell EMC AppSync
• Remote code execution in vRealize Orchestrator (vRO) Plug-ins for Dell EMC Storage
• Remote code execution in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in Dell Wyse Management Suite
• Multiple vulnerabilities in Dell VxRail
• Remote code execution in IBM Tivoli Monitoring Spring Framework
• Code Injection in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in Oracle Commerce Guided Search
• Code Injection in IBM Process Mining
• FortiSOAR update for Spring4Shell vulnerabilities
• Multiple vulnerabilities in Oracle Managed File Transfer
• Code Injection in Oracle Data Integrator
• Multiple vulnerabilities in Oracle Insurance Policy Administration Operational Data Store for Life and Annuity
• Multiple vulnerabilities in Autodesk InfraWorks
• Multiple vulnerabilities in IBM Cognos Controller
• Multiple vulnerabilities in IBM Engineering Requirements Management DOORS/DWA
• Code injection in IBM watsonx.data
• Code Injection in Fuse 7.10
• Ubuntu update for libspring-java
• Code Injection in IBM Sterling Control Center
• IBM Sterling Connect:Direct for UNIX update for Spring Framework
• IBM Robotic Process Automation with Automation Anywhere update for Spring Framework
• IBM Planning Analytics Workspace update for Spring Framework
• Multiple vulnerabilities in IBM Library Support for Spring
• Multiple vulnerabilities in IBM Terracotta