flawopen.com/Teardowns/CVE-2022-22965 Spring4Shell

CVE-2022-22965: Spring4Shell ClassLoader Binding RCE

Critical 9.8 CWE-94 Patch Teardown

ELI5 — The Delivery Box with Master Override

Imagine ordering a customized sandwich online: bread=wheat, cheese=cheddar. But the ordering form lets you type 'kitchen.oven.temperature=5000' and the restaurant's computer blindly adjusts the restaurant's actual kitchen machinery! In Spring4Shell, an attacker used standard HTTP parameters to navigate into the internal Java classloader, telling the web server to create a new log file called 'shell.jsp' and write executable hacker commands into it.

Target: Spring Framework running on JDK 9+ and Apache Tomcat

Vector: HTTP POST parameters targeting class.module.classLoader

Impact: Arbitrary remote code execution via webshell drop

Remediation: Disallowing access to ClassLoader and ProtectionDomain in property binding

The Mechanism & Root Cause

Spring MVC automatically binds HTTP parameters to Java Beans. While Spring previously blocked class.classLoader, JDK 9 introduced Java Modules. Attackers bypassed the check by traversing class.module.classLoader, reaching Tomcat's AccessLogValve and changing its file prefix to shell.jsp and writing JSP code directly into web directories.

CachedIntrospectionResults.java (Vulnerable Spring Framework)Vulnerable

// VULNERABLE: Only blocked 'classLoader' directly, missing 'module'
if (Class.class == beanClass && ("classLoader".equals(pd.getName()) || 
    "protectionDomain".equals(pd.getName()))) {
    continue; // Bypassed via class.module.classLoader on Java 9+
}

CachedIntrospectionResults.java (Patched Spring Framework)Hardened

// FIXED: Strictly restrict all Class property access except 'name'
if (Class.class == beanClass && (!"name".equals(pd.getName()))) {
    continue; // Disallows classLoader, module, and all reflection entry points
}

The Attack & Exploit Sequence

1Attacker submits HTTP POST parameters targeting Tomcat's log configuration: class.module.classLoader.resources.context.parent.pipeline.first.prefix=shell.
2Attacker sets the suffix to .jsp and pattern to an executable JSP webshell snippet.:
3Tomcat creates webapps/ROOT/shell.jsp and writes the payload into it.:
4Attacker accesses http://victim/shell.jsp?cmd=whoami, executing arbitrary commands with web server privileges.

Defensive Engineering & Prevention Rules

✓Adopt Property Binding Allowlisting: Never permit open-ended parameter binding on POJOs. Explicitly specify allowed fields using @InitBinder or DataBinder.setAllowedFields().
✓Deploy as Executable JARs / Embedded Tomcat: Spring Boot applications running as standalone embedded JARs were immune because they use custom ClassLoaders without Tomcat AccessLogValve exposure.
✓Keep Frameworks Updated: Framework property binding bugs recur across versions. Implement automated dependency patching with Dependabot or Renovate.
✓Enforce Read-Only Container Webroots: Make the web document root strictly read-only to prevent unauthorized script creation even if classloader parameters are modified.

Explore related security topics and post-mortems: Complete Security Directory →