Spring4Shell PoC in NCL Testbed

In the current Java based web application ecosystem, a framework called Spring is dominantly in use (in more than 60% of applications). On March 30th, 2022, two critical vulnerabilities, CVE-2022-22963 and CVE-2022-22965, were reported, which pose a major threat to applications developed with the Spring framework. The first vulnerability affected the “spring-cloud-function-context" library (org.springframework.cloud). The latter, CVE-2022-22965, widely known as Spring4Shell, affected “spring-beans” (org.springframework.cloud). In this report we focus on Spring4Shell vulnerability, which can allow Remote Code Execution (RCE) on the server that is running the web application, by unauthorized and malicious actors.

The library org.springframework.cloud: spring-beans, is a typical transitive dependency of a popular framework used widely in Java applications and requires Java Development Kit version 9 (JDK9) or newer to be running. It is a bypass for an older CVE, CVE-2010-1622 that due to a feature in JDK9 or newer seems to have been reinstated (confirmed by the Praetorian). Since the time of writing, Spring has also confirmed that the currently known forms of an attack that exploits Spring4Shell, require JDK9 or above as well as Tomcat 9.0. Applications developed with these dependencies must be packaged as a WAR, and the vulnerable class to be present for the exploits to compromise the web application server. This type of vulnerability relies on the software deserializing code, which is at the root of the problem.

This vulnerability was identified early Wednesday (March 30th 2022) morning (GMT) when some speculations began to surface on the Internet (QQ Chat Service) about a new remote code execution flaw that affects Spring Framework. This vulnerability, dubbed by some as "Springshell or Spring4Shell" in the community, is a new, previously unknown (zero-day) security vulnerability. It has been added to the CVE list as CVE-2022-22965 with a Severity Score (CVSS) of 9.8.

Spring has acknowledged the vulnerability and released 5.3.18 and 5.2.20 to patch the issue as well as version 2.6.6 for spring-boot. We recommend an immediate upgrade for all users.

Some of the technical resources have confirmed that this serious vulnerability affects the spring-beans and spring artifacts under the following conditions:

·   JDK 9 or higher

·   Apache Tomcat as the Servlet container

·   Packaged as a traditional WAR (in contrast to a Spring Boot executable jar)

·   spring-webmvc or spring-webflux dependency

·   Spring Framework versions 5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and older versions

Several POCs have been devised to verify these vulnerabilities in blogs or repositories like (e.g., check GitHub repositories https://github.com/search?q=Spring4Shell) and they were set up in local environments. However, it may not be easy for some professionals and researchers to replicate the vulnerability to study their effects. Even when the vulnerability and the exploit are replicated on local environments, it may not be possible to share those environments with multiple parties (teams of investigation) and to transfer the experience on how this vulnerability operates.

NCL created environments that are widely available for the users based on the early POC code from Lunasec-io/Spring4Shell-POC. This environment is easily accessible by using a unique NCL client software. The client includes a description of the vulnerability and a step-by-step POC such as service/package preparation, exploitation, and verification. Please find below the example video on accessing this environment in the NCL testbed.

https://www.youtube.com/watch?v=0oyyGyx7DU8

Source:

https://blog.sonatype.com/new-0-day-spring-framework-vulnerability-confirmed

https://help.sonatype.com/docs/important-announcements/find-and-fix-springshell

https://github.com/lunasec-io/Spring4Shell-POC