Spring4Shell (CVE-2022-22965) - Remote Code Execution Proof of Concept

A fully containerized Proof of Concept (PoC) demonstrating the exploitation of Spring4Shell (CVE-2022-22965), resulting in Remote Code Execution (RCE) against a vulnerable Spring Framework application deployed on Apache Tomcat.

The project recreates the complete vulnerable environment to facilitate security research, penetration testing practice, vulnerability analysis, and defensive learning in a safe and reproducible laboratory.

Disclaimer

This repository is provided strictly for educational, research, and authorized security testing purposes. The vulnerable environment is intentionally insecure and must only be executed in isolated lab conditions. The author assumes no responsibility for misuse or any damage resulting from the use of this project.

---

Overview

Spring4Shell (CVE-2022-22965) is a critical Remote Code Execution vulnerability affecting specific versions of the Spring Framework when deployed on Apache Tomcat under particular runtime conditions.

This repository provides a fully reproducible laboratory environment that allows researchers and students to understand:

• how the vulnerability works;
• the exploitation workflow;
• the conditions required for successful exploitation;
• practical mitigation strategies.

The application is completely isolated inside a Docker container, allowing experimentation without affecting the host operating system.

---

Target Environment

Component	Version	Description
Spring Boot	2.6.2	Vulnerable application
Spring Framework	5.3.14	Vulnerable version
Apache Tomcat	9.0.60	Servlet container
Java	JDK 11	Required runtime
Operating System	Ubuntu 24.04	Docker container

---

Repository Structure

.
├── Dockerfile
├── pom.xml
├── src/
│   ├── main/
│   └── test/
├── README.md
└── exploit/

---

Getting Started

Clone the repository

git clone https://github.com/<username>/<repository>.git
cd <repository>

Build the Docker image

docker build -t spring4shell:2.6.2 .

Run the vulnerable application

docker run -p 8080:8080 spring4shell:2.6.2

The application will be available at:

http://localhost:8080

---

Exploitation Workflow

The repository demonstrates the complete attack chain:

1. Deploy the vulnerable application.
2. Verify exploit prerequisites.
3. Deliver the malicious payload.
4. Modify Tomcat logging configuration.
5. Write the malicious JSP web shell.
6. Execute arbitrary commands through the deployed shell.

---

Learning Objectives

This project covers several important offensive security concepts:

• Spring MVC Data Binding
• Java Reflection
• Apache Tomcat internals
• Remote Code Execution (RCE)
• Web Application Security
• Vulnerability Reproduction
• Secure Lab Deployment
• Defensive Analysis

---

Mitigation

To mitigate CVE-2022-22965:

• Upgrade to a patched version of the Spring Framework.
• Upgrade Apache Tomcat where applicable.
• Apply the official Spring Security advisories.
• Restrict unnecessary data binding.
• Continuously patch application dependencies.
• Never expose intentionally vulnerable environments to public networks.

---

References

• CVE-2022-22965
• Spring Security Advisory
• VMware Security Advisory
• Apache Tomcat Documentation
• NIST National Vulnerability Database (NVD)

---

⭐ If you find this project useful for learning or security research, consider giving it a star ⭐