技術解説とコード分析：CVE-2022-22965: Spring4Shell ClassLoader Binding RCE

CVE-2022-22965 に関する技術的なソースコード詳細解析とシステム堅牢化対策：脆弱性の根本原因、攻撃フロー、および安全なパッチ実装の詳細な解説。

💡 わかりやすい解説 (ELI5)

直感的な物理的アナロジー解説：Imagine ordering a customized sandwich online: bread=wheat, cheese=cheddar. But the ordering form lets you type 'kitchen.oven.temperature=5000' and the restaurant's computer blindly adjusts the restaurant's actual kitchen machinery! In Spring4Shell, an attacker used standard HTTP parameters to navigate into the internal Java classloader, telling the web server to create a new log file called 'shell.jsp' and write executable hacker commands into it.

主要な概念と専門用語

Open Source Systems: 主要概念 (Open Source Systems)：Core architecture component affected by CWE-Security.
CWE-Security: 主要概念 (CWE-Security)：Standard Common Weakness Enumeration classification for cve-2022-22965-spring4shell.
Defense-in-Depth: 主要概念 (Defense-in-Depth)：Multi-layered engineering verification and runtime boundary isolation.

根本原因の分析 (Root Cause)

根本原因は、オープンソースシステムにおける未検証の境界パラメータに起因し、状態の非同期化とセキュリティ制御の迂回を可能にします。

ステップ・バイ・ステップの攻撃フロー

Step 1

Tomcat Logging Property Binding

Attacker submits HTTP POST parameters targeting Tomcat's class loader: class.module.classLoader.resources.context.parent.pipeline.first.prefix=shell.

Step 2

JSP Extension & Pattern Configuration

Attacker sets the log suffix to .jsp and pattern to an executable JSP webshell snippet.

Step 3

Webshell File Creation

Tomcat's AccessLogValve flushes access logs, creating webapps/ROOT/shell.jsp with executable payload code.

Step 4

Arbitrary Remote Command Execution

Attacker accesses http://victim/shell.jsp?cmd=whoami, executing arbitrary commands with web server privileges.

ソースコード比較：脆弱 vs 堅牢化

✕ 脆弱な実装

// VULNERABLE: Only blocked 'classLoader' directly, missing 'module'
if (Class.class == beanClass && ("classLoader".equals(pd.getName()) || 
    "protectionDomain".equals(pd.getName()))) {
    continue; // Bypassed via class.module.classLoader on Java 9+
}

✓ 堅牢化されたセキュアパッチ

// FIXED: Strictly restrict all Class property access except 'name'
if (Class.class == beanClass && (!"name".equals(pd.getName()))) {
    continue; // Disallows classLoader, module, and all reflection entry points
}

エンジニアリング＆システム堅牢化チェックリスト

✓推奨されるセキュリティ対策：Attacker submits HTTP POST parameters targeting Tomcat's log configuration: class.module.classLoader.resources.context.parent.pipeline.first.prefix=shell。
✓推奨されるセキュリティ対策：Attacker sets the suffix to .jsp and pattern to an executable JSP webshell snippet.:。
✓推奨されるセキュリティ対策：Tomcat creates webapps/ROOT/shell.jsp and writes the payload into it.:。
✓推奨されるセキュリティ対策：Attacker accesses http://victim/shell.jsp?cmd=whoami, executing arbitrary commands with web server privileges。