VMware · Spring Framework
Spring Framework's data binding in Spring MVC and Spring WebFlux applications running on JDK 9+ contains a flaw that can lead to remote code execution. The flaw is in how these applications handle data binding, and it is specifically exposed when the application is deployed as a WAR on Tomcat, while Spring Boot executable jars are not affected by the specific exploit described. An attacker with network access and no authentication or user interaction could send crafted requests to a vulnerable WAR-deployed application to execute code on the server.
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
First seen exploited 3 days after disclosure. Public exploit code (PoC-in-GitHub) was available 2 days before disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
2 related vulnerabilities in the same code over 6 weeks. The latest fix listed for spring-webmvc is 6.0.14.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
This remote code execution (RCE) vulnerability affects Spring MVC or Spring WebFlux applications running on JDK 9+ when deployed on Tomcat as a WAR file. This vulnerability can be exploited by a remote attacker via data binding, allowing malicious actors to execute arbitrary code. Specifically, it has been used to deploy and execute the Mirai botnet malware. The exploit involves downloading a Mirai sample to the "/tmp" directory and changing its permissions to make it executable using "chmod." The malware is then executed, enabling further malicious activities. The vulnerability does not affect applications deployed as Spring Boot executable jars. Observations of this exploit began in early April 2022, with malware variants available for different CPU architectures.
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
5 packages in 1 ecosystem. No single main package: each of these ships the affected code.
Reports are matched by finding the exact id CVE-2022-22965 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
…threat activity group detected An active ‘PrivateLoader’ malware process was detected while executing ‘Morila’ malware was prevented ‘Multiverze’ malware was detected Microsoft Defender for Endpoint also has detections for the following vulnerabilities exploited by Zerobot: CVE-2022-22965…
2 passages name itOriginal (opens in a new tab) ↗
Mentions the CVE; no further detail.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.