CVE-2022-22965: Spring4Shell ClassLoader Binding RCE

Detaillierte technische Quellcode-Analyse und Härtungsmaßnahmen für CVE-2022-22965: Source code teardown of Spring4Shell (CVE-2022-22965): Java BeanWrapper property navigation into Tomcat AccessLogValve to write a webshell to disk.

💡 Einfache Erklärung (ELI5)

Anschauliche Analogie: Imagine ordering a customized sandwich online: bread=wheat, cheese=cheddar. But the ordering form lets you type 'kitchen.oven.temperature=5000' and the restaurant's computer blindly adjusts the restaurant's actual kitchen machinery! In Spring4Shell, an attacker used standard HTTP parameters to navigate into the internal Java classloader, telling the web server to create a new log file called 'shell.jsp' and write executable hacker commands into it.

Kernkonzepte & Begriffe

Open Source Systems: Kernkomponente der Architektur, die von CWE-Security betroffen ist.
CWE-Security: Standardmäßige Common Weakness Enumeration (CWE)-Klassifizierung für cve-2022-22965-spring4shell.
Defense-in-Depth: Mehrschichtige technische Verifikation und Laufzeit-Grenzenisolation.

Ursachenanalyse

Die Grundursache liegt in nicht validierten Grenzparametern in Open-Source-Systemen, die eine Zustandsdesynchronisation und die Umgehung von Sicherheitskontrollen ermöglichen.

Schritt-für-Schritt Angriffsablauf

Step 1

Tomcat Logging Property Binding

Attacker submits HTTP POST parameters targeting Tomcat's class loader: class.module.classLoader.resources.context.parent.pipeline.first.prefix=shell.

Step 2

JSP Extension & Pattern Configuration

Attacker sets the log suffix to .jsp and pattern to an executable JSP webshell snippet.

Step 3

Webshell File Creation

Tomcat's AccessLogValve flushes access logs, creating webapps/ROOT/shell.jsp with executable payload code.

Step 4

Arbitrary Remote Command Execution

Attacker accesses http://victim/shell.jsp?cmd=whoami, executing arbitrary commands with web server privileges.

Quellcode: Verwundbar vs. Sicher

✕ VERWUNDBARE IMPLEMENTIERUNG

// VULNERABLE: Only blocked 'classLoader' directly, missing 'module'
if (Class.class == beanClass && ("classLoader".equals(pd.getName()) || 
    "protectionDomain".equals(pd.getName()))) {
    continue; // Bypassed via class.module.classLoader on Java 9+
}

✓ GEHÄRTETER SICHERHEITS-PATCH

// FIXED: Strictly restrict all Class property access except 'name'
if (Class.class == beanClass && (!"name".equals(pd.getName()))) {
    continue; // Disallows classLoader, module, and all reflection entry points
}

Checkliste für Engineering & Systemsicherheit

✓Empfohlene Sicherheitsmaßnahme: Attacker submits HTTP POST parameters targeting Tomcat's log configuration: class.module.classLoader.resources.context.parent.pipeline.first.prefix=shell.
✓Empfohlene Sicherheitsmaßnahme: Attacker sets the suffix to .jsp and pattern to an executable JSP webshell snippet.:.
✓Empfohlene Sicherheitsmaßnahme: Tomcat creates webapps/ROOT/shell.jsp and writes the payload into it.:.
✓Empfohlene Sicherheitsmaßnahme: Attacker accesses http://victim/shell.jsp?cmd=whoami, executing arbitrary commands with web server privileges.