Spring Framework Remote Code Execution Vulnerability via Data Binding (Spring4Shell, CVE-2022-22965) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTSpring MVC or Spring WebFlux applications running on JDK 9+ and deployed as a WAR on Apache Tomcat.
Unauthenticated remote attackers can manipulate HTTP request parameters to modify Tomcat logging configurations and upload a web shell, leading to complete system compromise.
Immediately upgrade Spring Framework to secure versions (5.3.18+, 5.2.20+) or update the corresponding Spring Boot parent version.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The recommended remediation is to upgrade Spring Framework to version 5.3.18, 5.2.20, or higher.
For Maven-based projects, update the properties in pom.xml:
<!-- pom.xml -->
<properties>
<spring-framework.version>5.3.18</spring-framework.version>
</properties>For Gradle-based projects, update build.gradle:
// build.gradle
ext['spring-framework.version'] = '5.3.18'2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, configure a global ControllerAdvice to explicitly disallow binding to sensitive class loader properties.
@ControllerAdvice
@Order(Ordered.HIGHEST_PRECEDENCE)
public class BinderControllerAdvice {
@InitBinder
public void setAllowedFields(WebDataBinder binder) {
String denylist = new String{'class.*', 'Class.*', '*.class.*', '*.Class.*'};
binder.setDisallowedFields(denylist);
}
}3. Log Audit & IoC Verification Commands
Inspect Tomcat access logs and web directories for indicators of compromise (IoCs) related to class loader manipulation.
# Search Tomcat access logs for class loader manipulation attempts
grep -ri 'class.module.classLoader' /var/log/tomcat*/
# Scan the webapps directory for recently created suspicious JSP files
find /var/lib/tomcat*/webapps/ -name '*.jsp' -mtime -7Scan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability, widely known as 'Spring4Shell', resides in the data binding mechanism of Spring Framework when handling HTTP request parameters. Due to the module system introduced in JDK 9 and later, attackers can traverse the object graph via HTTP parameters to access the class.module.classLoader. Because Spring's CachedIntrospectionResults failed to restrict access to these specific class properties, it allowed arbitrary manipulation of the application's ClassLoader (CWE-94).
2. Exploitation Mechanics & Attack Scenario
An attacker sends a specially crafted HTTP POST or GET request targeting the Tomcat AccessLogValve properties. By manipulating parameters such as class.module.classLoader.resources.context.parent.pipeline.first.pattern, the attacker reconfigures Tomcat's logging to write a .jsp file into the web root directory (webapps/ROOT) and injects malicious Java code into the log pattern. Subsequent requests trigger the execution of the newly created JSP web shell, granting the attacker remote OS command execution capabilities.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical) and inclusion in the CISA KEV catalog, this vulnerability poses an extreme risk. Successful exploitation allows arbitrary code execution under the privileges of the web server process, potentially leading to lateral movement, database credential theft, ransomware deployment, and complete infrastructure compromise.
Official Vendor Advisories & References
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
Frequently Asked SecOps Questions (CVE-2022-22965)
FAQQ1. How critical is CVE-2022-22965 and is it actively exploited in the wild?
CVE-2022-22965 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.6%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2022-22965?
Primary impacted vendors include vmware, spring across spring_framework, spring_boot. Scope summary: Spring Framework versions 5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and older unsupported versions running on JDK 9+ (specifically when deployed as a WAR on Apache Tomcat).
Q3. What temporary mitigations or workarounds exist for CVE-2022-22965 before patching?
[Mitigation] Immediately upgrade Spring Framework to secure versions (5.3.18+, 5.2.20+) or update the corresponding Spring Boot parent version. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2022-22965
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (vmware)
View Category →Arista VeloCloud Orchestrator (VCO) On-Premises Remote Code Execution and Privilege Bypass (CVE-2026-16812)
[Affected Scope] On-premises deployments of VeloCloud Orchestrator (VCO)
VeloCloud Orchestrator (VCO) Privilege Escalation and Internal Access Vulnerability (CVE-2026-114625)
[Affected Scope] On-premise deployments of VeloCloud Orchestrator (VCO).
VMware vCenter Server Syslog Service Directory Traversal Remote Code Execution Vulnerability (CVE-2026-59310)
[Affected Scope] Systems running VMware vCenter Server with the built-in Syslog server service enabled.
VMware Aria Operations Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-22719)
[Affected Scope] VMware Aria Operations instances with support-assisted product migration in progress
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.