{"slug":"spring4shell","title":"Spring4Shell (CVE-2022-22965)","shortName":"Spring4Shell","summary":"Remote code execution in Spring MVC / WebFlux data binding on JDK 9+ when deployed as a WAR on certain servlet containers. CVSS 9.8. Listed in CISA KEV on 4 Apr 2022. Public PoCs and in-the-wild scanning followed disclosure.","isExample":false,"draft":false,"family":"spring4shell","kind":"framework","aliases":["CVE-2022-22965","SpringShell","Spring Framework RCE"],"publishedAt":"2022-03-31","updatedAt":"2026-10-24","patchStatus":"patched","exploited":true,"scores":{"cve":"CVE-2022-22965","cvss":{"cve":"CVE-2022-22965","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1","scorer":"nvd","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2022-22965","sourceDate":"2026-06-17","checkedDate":"2026-10-24"},"epss":{"cve":"CVE-2022-22965","score":0.99638,"percentile":0.9995,"date":"2026-10-23","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2022-22965","checkedDate":"2026-10-24"},"kev":{"cve":"CVE-2022-22965","listed":true,"dateAdded":"2022-04-04","dueDate":"2022-04-25","catalogVersion":"2026.10.23","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-10-24"},"addedDate":"2026-10-24"},"priority":{"label":"act-now"},"managementSummary":{"what":"Remote code execution in Spring MVC / WebFlux data binding (CVE-2022-22965) on JDK 9+ WAR deployments. Listed in CISA KEV.","action":"Confirm Spring Framework or Spring Boot is on a fixed release, and review remaining WAR deployments on standalone servlet containers."},"seenInTheWild":[{"metric":"scanning","value":"~37K exploitation attempts in the first weekend; 16% of organizations worldwide saw attempts in the first 4 days","observer":"Check Point","date":"2022-04-05","method":"Vendor gateway telemetry","sourceUrl":"https://blog.checkpoint.com/security/16-of-organizations-worldwide-impacted-by-spring4shell-zero-day-vulnerability-exploitation-attempts-since-outbreak/"},{"metric":"exploitation-confirmed","value":"Listed","observer":"CISA","date":"2022-04-04","method":"CISA Known Exploited Vulnerabilities catalog dateAdded","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"}],"seenInTheWildLinks":[{"title":"Spring Core RCE Attempt","url":"https://viz.greynoise.io/tags/spring-core-rce-attempt","observer":"GreyNoise","metric":"scanning"}],"whatChanged":{"date":"2026-10-24","items":[{"text":"Added Am I affected checks, mitigations and response guidance","section":"am-i-affected"},{"text":"Act-now priority block with sourced CVSS, EPSS, and CISA KEV dates.","section":"priority","addedDate":"2026-10-24"},{"text":"Detection rule coverage table and JSON, IOC CSV, and STIX feeds.","section":"detection","addedDate":"2026-10-24"}]},"whatTheBugIs":"Spring4Shell is the public name for CVE-2022-22965 in the Spring Framework. codeplutos and meizjm3i of AntGroup FG Security Lab reported it to VMware. Praetorian filed a secondary report. Spring published the CVE and fixes on 31 Mar 2022.\n\nA Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. Spring Boot executable JARs with an embedded container are not vulnerable to that exploit path, but Spring warns the issue is more general and other vectors may exist.\n\nAffected Spring Framework versions include 5.3.0 to 5.3.17 and 5.2.0 to 5.2.19 (and earlier). Fixed in 5.3.18 and 5.2.20. Spring Boot 2.6.6 and 2.5.12 consume the fixed Framework. Apache Tomcat also released 10.0.20, 9.0.62, and 8.5.78 as a mitigation on the container side.","attackPath":{"caption":"High-level only. Not a reproduction guide.","steps":[{"id":"bind","label":"Data binding","detail":"Request parameters populate a controller argument through Spring data binding on JDK 9+."},{"id":"classloader","label":"ClassLoader access","detail":"Binding reaches ClassLoader-related properties on certain servlet containers such as Tomcat."},{"id":"write","label":"Writable path","detail":"The exploit path can manipulate access logging so a JSP webshell lands under a web application directory."},{"id":"exec","label":"Code exec","detail":"The webshell or equivalent payload runs with the application server privileges. Conceptual impact class only."}]},"exploitation":{"kev":{"listed":true,"date":"2022-04-04","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"CISA KEV entry for CVE-2022-22965, Spring Framework JDK 9+ Remote Code Execution Vulnerability. dateAdded 2022-04-04."},"firstSeen":{"date":"2022-03-30","source":"Unit 42","note":"Unit 42 first observed scanning traffic early on 30 Mar 2022 with HTTP requests containing test strings in the URL."},"vendorStatements":[{"vendor":"Spring / VMware","date":"2022-03-31","statement":"A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. Spring Framework 5.3.18 and 5.2.20 contain the fixes.","url":"https://spring.io/security/cve-2022-22965","retracted":false},{"vendor":"Unit 42","date":"2022-03-31","statement":"Unit 42 has observed CVE-2022-22965 being exploited in the wild. Signature hits totaled 43,092 in the first seven days after release.","url":"https://unit42.paloaltonetworks.com/cve-2022-22965-springshell/","retracted":false},{"vendor":"Trend Micro","date":"2022-04-01","statement":"Trend Micro discovered active exploitation that downloads Mirai botnet malware to /tmp and executes it after chmod.","url":"https://www.trendmicro.com/en_us/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html","retracted":false}]},"timeline":[{"date":"2022-03-30","event":"Unit 42 observes early scanning with Spring4Shell test strings.","source":{"title":"CVE-2022-22965 SpringShell","url":"https://unit42.paloaltonetworks.com/cve-2022-22965-springshell/","publisher":"Unit 42"},"kind":"exploited","key":true},{"date":"2022-03-31","event":"Spring publishes CVE-2022-22965 and releases Framework 5.3.18 and 5.2.20 plus Boot 2.6.6 / 2.5.12.","source":{"title":"Spring Framework RCE via Data Binding on JDK 9+","url":"https://spring.io/security/cve-2022-22965","publisher":"Spring"},"kind":"patch","key":true},{"date":"2022-03-31","event":"Public PoC repositories such as reznok/Spring4Shell-POC appear.","source":{"title":"Spring4Shell-POC","url":"https://github.com/reznok/Spring4Shell-POC","publisher":"reznok"},"kind":"poc","key":true},{"date":"2022-04-01","event":"Apache Tomcat releases 10.0.20, 9.0.62, and 8.5.78 as a container-side mitigation.","source":{"title":"Spring Framework RCE, Mitigation Alternative","url":"https://spring.io/blog/2022/04/01/spring-framework-rce-mitigation-alternative","publisher":"Spring"},"kind":"patch","key":true},{"date":"2022-04-04","event":"CISA adds CVE-2022-22965 to KEV. Microsoft publishes protection and detection guidance.","source":{"title":"CISA KEV catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"kev","key":true},{"date":"2022-04-01","event":"Trend Micro reports Mirai botnet payloads delivered through Spring4Shell exploitation (activity from the start of April 2022).","source":{"title":"Analyzing the Exploitation of Spring4Shell","url":"https://www.trendmicro.com/en_us/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html","publisher":"Trend Micro"},"kind":"exploited","key":true}],"defenderActions":[{"title":"Upgrade Spring Framework","detail":"Move to Spring Framework 5.3.18 or 5.2.20 (or later). Spring Boot users should move to 2.6.6, 2.5.12, or later releases that pull in the fixed Framework.","priority":"now","links":[{"label":"Spring CVE-2022-22965","href":"https://spring.io/security/cve-2022-22965"}]},{"title":"If you cannot upgrade Spring quickly","detail":"Spring documents tactical options: upgrade Tomcat to 10.0.20 / 9.0.62 / 8.5.78, set disallowedFields on WebDataBinder, or (as a last resort) leave JDK 8. Prefer upgrading Spring.","priority":"soon","links":[{"label":"Spring early announcement","href":"https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement"}]},{"title":"Confirm deployment shape","detail":"The classic exploit path needs JDK 9+, a vulnerable Spring web dependency, and a WAR on a standalone servlet container such as Tomcat. Inventory WAR deployments first, then review other data-binding endpoints.","priority":"soon"},{"title":"Hunt for webshells under web roots","detail":"Microsoft and Unit 42 describe JSP webshells written under Tomcat web application directories after successful exploitation. Search for unexpected .jsp files and related process activity.","priority":"soon","links":[{"label":"Microsoft SpringShell guidance","href":"https://www.microsoft.com/en-us/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/"}]}],"detection":[{"title":"class.module.classLoader binding in requests","detail":"Microsoft documents requests that touch class.module.classLoader properties (for example class.module.classLoader.URLs). Search HTTP access logs and WAF events for those parameter names.","logSource":"Web access logs / reverse-proxy logs","kind":"generic","group":"web-proxy"},{"title":"Unexpected JSP files under Tomcat webapps","detail":"Observed exploitation dropped JSP webshells into Tomcat web application directories. Alert on new .jsp files under web roots.","logSource":"EDR / process telemetry","kind":"generic","group":"edr"},{"title":"Akamai Kona / App & API Protector: rule 3000023 and AAG 1000005","detail":"Akamai named KRS/ASE rule 3000023 (Apache Struts ClassLoader Manipulation) and AAG Command Injection rule 1000005 as detecting Spring4Shell (CVE-2022-22965).","logSource":"Akamai Security Events (WAF) logs","kind":"vendor-signature","url":"https://www.akamai.com/blog/security/spring-core-spring4shell-zero-day","date":"2022-03-31"},{"title":"Azure WAF: DRS 99001015 / 99005006, CRS 800110 / 800112","detail":"DRS rule 99001015 (CVE-2022-22965) and 99005006 (Spring4Shell interaction attempt). CRS 3.x rules 800110 and 800112. Rule reference page has no per-rule date.","logSource":"Azure WAF diagnostic logs (ApplicationGatewayFirewallLog)","kind":"vendor-signature","url":"https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules","date":"2026-10-23"},{"title":"NetScaler WAF signatures: 999004 / 18959","detail":"NetScaler WAF signature update version 79 updated rule 18959 and version 80 added rule 999004 (WEB-MISC Spring4Shell Spring Core RCE) for CVE-2022-22965.","logSource":"NetScaler WAF (AppFw) logs","kind":"vendor-signature","url":"https://docs.netscaler.com/en-us/citrix-adc/13-1/signature-alerts/signature-update-version-79.html","date":"2026-10-23","dateKind":"checked"},{"title":"Cloudflare WAF Managed Rules: 100524 Spring - Code Injection","detail":"Rule 100524 (d58ebf53...f2cc4e84) released 2022-03-31, blocking by default from 2022-04-04. Renamed and set disabled by default on 2024-07-29.","logSource":"Cloudflare Security Events / Firewall events","kind":"vendor-signature","url":"https://blog.cloudflare.com/waf-mitigations-spring4shell/","date":"2022-03-31"},{"title":"Fastly Next-Gen WAF: virtual patch CVE-2022-22965","detail":"Virtual patches for CVE-2022-22963 and CVE-2022-22965 added 2022-03-31.","logSource":"Fastly Next-Gen WAF signal logs","kind":"vendor-signature","url":"https://www.fastly.com/documentation/reference/changes/2022/03/added-virtual-patches-for-cve-2022-22963-and-cve-2022-22965/","date":"2022-03-31"},{"title":"Fortinet FortiWeb: 1090501439","detail":"FortiWeb signature Spring.Framework.SerializationUtils.Insecure.Deserialization (1090501439), 2022-03-31. FortiADC WAF 1002017263 also listed.","logSource":"FortiWeb attack logs","kind":"vendor-signature","url":"https://www.fortiguard.com/outbreak-alert/spring4shell-vulnerability","date":"2026-10-23","dateKind":"checked"},{"title":"Imperva Cloud WAF / WAF Gateway: existing rules","detail":"Imperva states existing rules for older CVEs (for example CVE-2015-1427) block CVE-2022-22965 out of the box. No new rule ID published.","logSource":"WAF event logs","kind":"vendor-signature","url":"https://www.imperva.com/blog/imperva-protects-from-new-spring-framework-zero-day-vulnerabilities/","date":"2022-03-31"},{"title":"Check Point IPS: CPAI-2022-0104","detail":"Protection 'Spring Core Remote Code Execution (CVE-2022-22965)', published 2022-03-31.","logSource":"Check Point IPS logs (SmartConsole / Logs & Monitor)","kind":"vendor-signature","url":"https://advisories.checkpoint.com/defense/advisories/public/2022/cpai-2022-0104.html","date":"2022-03-31"},{"title":"Cisco Talos Snort: 1:30790-30793, 1:59416","detail":"Talos lists SIDs 30790-30793 and 59416 for Spring4Shell. Rule docs 1:30793 and 1:59416 reference CVE-2022-22965. (59388 covers CVE-2022-22963.)","logSource":"Snort / Cisco Secure Firewall IPS event logs","kind":"vendor-signature","url":"https://blog.talosintelligence.com/threat-advisory-spring4shell/","date":"2022-03-31"},{"title":"Fortinet FortiGuard IPS: 51352","detail":"IPS signature Spring.Framework.SerializationUtils.Insecure.Deserialization (51352), 2022-03-30.","logSource":"FortiGate IPS logs","kind":"vendor-signature","url":"https://www.fortiguard.com/search?q=CVE-2022-22965&engine=1","date":"2022-03-31"},{"title":"Juniper IDP: HTTP:CTS:VMWR-SPRING-CORE-RCE","detail":"IDP signature for CVE-2022-22965, release date 2022-03-31, recommended action Drop.","logSource":"Juniper SRX IDP logs","kind":"vendor-signature","url":"https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.HTTP:CTS:VMWR-SPRING-CORE-RCE.html","date":"2022-03-31"},{"title":"Palo Alto Networks / Unit 42 Spring Core RCE signature","detail":"Unit 42 reports a Spring Core Remote Code Execution Vulnerability threat prevention signature that triggered 43,092 times in its first week.","logSource":"WAF / IPS event logs","kind":"vendor-signature","url":"https://unit42.paloaltonetworks.com/cve-2022-22965-springshell/","date":"2022-03-31"},{"title":"Trend Micro Deep Security 1011372, TippingPoint 41108","detail":"Deep Security IPS rule 1011372 and TippingPoint filter 41108 'HTTP: Spring Core Code Execution Vulnerability'.","logSource":"Trend Micro Deep Security / TippingPoint SMS event logs","kind":"vendor-signature","url":"https://success.trendmicro.com/en-US/solution/KA-0012910","date":"2026-10-23","dateKind":"checked"},{"title":"Zscaler ATP: HTML.Exploit.Spring4Shell","detail":"Advanced Threat Protection signature HTML.Exploit.Spring4Shell, also listed for ZPA with Application Security.","logSource":"Zscaler ZIA web / threat logs","kind":"vendor-signature","url":"https://www.zscaler.com/blogs/security-research/analysis-spring-cloud-framework-vulnerabilities","date":"2022-03-31"}],"detectionRules":[{"id":"splunk-spring4shell-class-module","title":"Web Spring4Shell HTTP Request Class Module","language":"spl","query":"`stream_http` http_method IN (\"POST\")\n  | stats values(form_data) as http_request_body min(_time) as firstTime max(_time) as lastTime count\n    BY src dest http_method\n       http_user_agent uri_path url\n       bytes_in bytes_out\n  | search http_request_body IN (\"*class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat=_*\", \"*class.module.classLoader.resources.context.parent.pipeline.first.pattern*\",\"*suffix=.jsp*\")\n  | `security_content_ctime(firstTime)`\n  | `security_content_ctime(lastTime)`\n  | `web_spring4shell_http_request_class_module_filter`","logSource":"Splunk Stream HTTP (request bodies)","author":"Michael Haag, Splunk","authorUrl":"https://research.splunk.com/","sourceUrl":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/web/web_spring4shell_http_request_class_module.yml","sourceDate":"2026-05-13","license":"Apache-2.0","origin":"vendor","notes":"Uses Splunk ES macros and data models from splunk/security_content; the trailing _filter macro is a tuning hook.","tested":"tested","testedNote":"Splunk security_content YAML includes a True Positive Test and status production.","testedSourceUrl":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/web/web_spring4shell_http_request_class_module.yml"},{"id":"splunk-java-writing-jsp","title":"Java Writing JSP File","language":"spl","query":"| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes\n  WHERE Processes.process_name IN (\"java\",\"java.exe\", \"javaw.exe\")\n  BY _time Processes.action Processes.dest\n     Processes.original_file_name Processes.parent_process Processes.parent_process_exec\n     Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name\n     Processes.parent_process_path Processes.process Processes.process_exec\n     Processes.process_guid Processes.process_hash Processes.process_id\n     Processes.process_integrity_level Processes.process_name Processes.process_path\n     Processes.user Processes.user_id Processes.vendor_product\n| `drop_dm_object_name(Processes)`\n| join process_guid [\n| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem\n  WHERE Filesystem.file_name=\"*.jsp*\"\n  BY _time Filesystem.action Filesystem.dest\n     Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash\n     Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path\n     Filesystem.file_acl Filesystem.file_size Filesystem.process_guid\n     Filesystem.process_id Filesystem.user Filesystem.vendor_product\n| `drop_dm_object_name(Filesystem)`\n| fields _time process_guid file_path file_name file_create_time user dest process_name]\n| stats count min(_time) as firstTime max(_time) as lastTime\n  BY dest process_name process_guid\n     file_name file_path file_create_time\n     user\n| `security_content_ctime(firstTime)`\n| `security_content_ctime(lastTime)`\n| `java_writing_jsp_file_filter`","logSource":"Sysmon EventID 1 and 11 (Endpoint data models)","author":"Michael Haag, Splunk","authorUrl":"https://research.splunk.com/","sourceUrl":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/endpoint/java_writing_jsp_file.yml","sourceDate":"2026-05-13","license":"Apache-2.0","origin":"vendor","notes":"Uses Splunk ES macros and data models from splunk/security_content; the trailing _filter macro is a tuning hook.","tested":"tested","testedNote":"Splunk security_content YAML includes a True Positive Test and status production.","testedSourceUrl":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/endpoint/java_writing_jsp_file.yml"},{"id":"sentinel-springshell-waf","title":"Possible SpringShell Exploitation Attempt (CVE-2022-22965)","language":"kql","query":"let spring4shellstring = dynamic([\"class.module.classLoader.resources.context.parent.pipeline.first.pattern=\"]);\nAzureDiagnostics\n| where Category in (\"FrontdoorWebApplicationFirewallLog\", \"FrontdoorAccessLog\", \"ApplicationGatewayFirewallLog\", \"ApplicationGatewayAccessLog\")\n| extend originalRequestUriWithArgs_s = column_ifexists(\"originalRequestUriWithArgs_s\", \"\"), \n   userAgent_s = column_ifexists(\"userAgent_s\", \"\"), \n   clientIP_s = column_ifexists(\"clientIP_s\", \"\"),  \n   clientPort_d = column_ifexists(\"originalRequestUriWithArgs_s\", \"\"),\n   host_s = column_ifexists(\"host_s\", \"\"),\n   requestUri_s = column_ifexists(\"requestUri_s\", \"\"),\n   httpStatus_d = column_ifexists(\"httpStatus_d\",\"\"),\n   listenerName_s = column_ifexists(\"listenerName_s\", \"\"),\n   httpMethod_s = column_ifexists(\"httpMethod_s\", \"\")\n| where httpMethod_s =~ 'POST'\n| where originalRequestUriWithArgs_s has_any (spring4shellstring) or requestUri_s has_any (spring4shellstring)\n| summarize Total = count() by originalRequestUriWithArgs_s, userAgent_s, clientIP_s,clientPort_d, TimeGenerated, host_s, requestUri_s, httpStatus_d,listenerName_s, httpMethod_s, Category\n| extend IPCustomEntity = clientIP_s, timestamp = TimeGenerated, UrlCustomEntity = requestUri_s, HostCustomEntity = host_s","logSource":"Azure Front Door / Application Gateway WAF logs (AzureDiagnostics)","author":"Microsoft Sentinel community (Azure/Azure-Sentinel)","authorUrl":"https://github.com/Azure/Azure-Sentinel","sourceUrl":"https://github.com/Azure/Azure-Sentinel/blob/464951510c3f4a9a35fa36e71fb4e9c969cd84db/Hunting%20Queries/AzureDiagnostics/SpringShellExploitationAttempt.yaml","sourceDate":"2022-04-05","license":"MIT","origin":"vendor","tested":"untested"},{"id":"sentinel-cve-2022-22965-network","title":"CVE-2022-22965 Network Activity","language":"kql","query":"DeviceNetworkEvents\n| where Timestamp > ago(7d)\n| where ActionType =~ \"NetworkSignatureInspected\"\n| where AdditionalFields contains \".jsp?cmd=\"\n| summarize makeset(AdditionalFields, 5), min(Timestamp), max(Timestamp) by DeviceId, DeviceName","logSource":"Microsoft Defender for Endpoint DeviceNetworkEvents (NetworkSignatureInspected)","author":"Microsoft Sentinel community (Azure/Azure-Sentinel)","authorUrl":"https://github.com/Azure/Azure-Sentinel","sourceUrl":"https://github.com/Azure/Azure-Sentinel/blob/464951510c3f4a9a35fa36e71fb4e9c969cd84db/Hunting%20Queries/Microsoft%20365%20Defender/Exploits/CVE-2022-22965%20Network%20Activity.yaml","sourceDate":"2022-06-23","license":"MIT","origin":"vendor","tested":"untested"},{"id":"et-spring4shell-rce-inbound","title":"ET EXPLOIT Possible SpringCore RCE/Spring4Shell Inbound (CVE-2022-22965)","language":"suricata","query":"alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:\"ET EXPLOIT Possible SpringCore RCE/Spring4Shell Inbound (CVE-2022-22965)\"; flow:established,to_server; http.request_body; content:\"pipeline.first.pattern=\"; fast_pattern; content:\"pipeline.first.suffix=\"; content:\"pipeline.first.directory=\"; content:\"pipeline.first.prefix=\"; classtype:attempted-admin; sid:2035678; rev:3; metadata:attack_target Server, created_at 2022_03_31, cve CVE_2022_22965, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 2024_03_08, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)","logSource":"Suricata IDS alerts (ET Open ruleset)","author":"Emerging Threats (Proofpoint)","authorUrl":"https://rules.emergingthreats.net/","sourceUrl":"https://rules.emergingthreats.net/open/suricata-7.0.3/rules/emerging-exploit.rules","sourceDate":"2024-03-08","license":"BSD-3-Clause (ET Open, sids 2000000-2799999)","origin":"vendor","tested":"untested"},{"id":"yara-springcore-webshell","title":"EXPL_POC_SpringCore_0day_Webshell_Mar22_1","language":"yara","query":"rule EXPL_POC_SpringCore_0day_Webshell_Mar22_1 {\n   meta:\n      description = \"Detects webshell found after SpringCore exploitation attempts POC script\"\n      author = \"Florian Roth (Nextron Systems)\"\n      reference = \"https://twitter.com/vxunderground/status/1509170582469943303\"\n      date = \"2022-03-30\"\n      score = 70\n      id = \"e7047c98-3c60-5211-9ad5-2bfdfb35d493\"\n   strings:\n      $x1 = \".getInputStream(); int a = -1; byte[] b = new byte[2048];\"\n      $x2 = \"if(\\\"j\\\".equals(request.getParameter(\\\"pwd\\\")\"\n      $x3 = \".getRuntime().exec(request.getParameter(\\\"cmd\\\")).getInputStream();\"\n   condition:\n     filesize < 200KB and 1 of them\n}","logSource":"JSP files under Tomcat webapps (YARA scan)","author":"Florian Roth (Nextron Systems)","authorUrl":"https://github.com/Neo23x0/signature-base","sourceUrl":"https://github.com/Neo23x0/signature-base/blob/3ce6640c26046da8e6d8094af3eaaee3ee84e648/yara/expl_spring4shell.yar","sourceDate":"2022-03-30","license":"DRL-1.1","origin":"community","tested":"untested"},{"id":"v2s-sigma-spring4shell-classloader-param","title":"Spring4Shell ClassLoader Parameter In Web Request","language":"sigma","query":"title: Spring4Shell ClassLoader Parameter In Web Request\nid: 7931ddcc-5eaf-51ab-8594-31098e8a64b9\nstatus: experimental\ndescription: Detects web requests that bind class.module.classLoader properties, the request shape Microsoft documents for CVE-2022-22965 (Spring4Shell). POST bodies are not in most access logs, so this mainly catches GET-based attempts and scanners.\nreferences:\n    - https://www.microsoft.com/en-us/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/\nauthor: vuln2shell\ndate: 2026-10-23\ntags:\n    - attack.initial-access\n    - attack.t1190\n    - cve.2022-22965\nlogsource:\n    category: webserver\ndetection:\n    selection:\n        cs-uri-query|contains: 'class.module.classLoader'\n    condition: selection\nfalsepositives:\n    - Vulnerability scanners\nlevel: high","logSource":"Web access logs / reverse-proxy logs","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/","sourceDate":"2022-04-04","license":"CC0 1.0","origin":"vuln2shell","notes":"Parameter name from Microsoft's guidance and Splunk's rule.","tested":"untested"},{"id":"v2s-logscale-spring4shell-classloader","title":"Spring4Shell ClassLoader parameter in web logs (LogScale)","language":"logscale","query":"/class\\.module\\.classLoader/i\n| groupBy([@host], function=count())","logSource":"Web access or WAF logs ingested into LogScale","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/","sourceDate":"2022-04-04","license":"CC0 1.0","origin":"vuln2shell","notes":"Free-text form of the Sigma rule.","tested":"untested"}],"detectionLinks":[{"title":"Microsoft: SpringShell RCE vulnerability guidance","url":"https://www.microsoft.com/en-us/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/","author":"Microsoft","date":"2022-04-04"},{"title":"Unit 42: SpringShell analysis","url":"https://unit42.paloaltonetworks.com/cve-2022-22965-springshell/","author":"Unit 42","date":"2022-03-31"},{"title":"Splunk: Spring4Shell Payload URL Request","url":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/web/spring4shell_payload_url_request.yml","author":"Splunk Threat Research Team"},{"title":"Elastic: Suspicious Child Execution via Web Server (Linux)","url":"https://github.com/elastic/detection-rules/blob/1b18e9c958f104a3cb049c565a216436deba272f/rules/linux/persistence_webserver_suspicious_child_execution.toml","author":"Elastic","date":"2026-10-05","note":"EQL; covers Tomcat Java parents."}],"retrohunt":{"summary":"Search back to 30 Mar 2022 for class.module.classLoader parameters and requests to the JSP webshell names Unit 42 lists, then check Tomcat web roots for new JSP files.","lookback":{"from":"2022-03-30","basis":"first-attempt","rationale":"Unit 42 first saw scanning with Spring4Shell test strings early on 30 Mar 2022. Public PoCs followed on 31 Mar. Start no later than 30 Mar 2022; webshells written then can still be on disk.","sources":[{"url":"https://unit42.paloaltonetworks.com/cve-2022-22965-springshell/","date":"2022-03-31","publisher":"Unit 42"}]},"logSources":[{"name":"Tomcat / servlet container access logs","why":"Exploit requests and later webshell use hit these.","required":true},{"name":"WAF and reverse-proxy logs","why":"Often the only place POST bodies with classLoader fields are visible.","required":true},{"name":"File integrity or EDR file events","why":"The exploit writes a .jsp file under the Tomcat webapps folder.","required":true},{"name":"EDR process telemetry","why":"Webshell commands show java spawning sh, bash, wget or curl.","required":false}],"steps":[{"title":"Scope to WAR deployments on Tomcat with JDK 9+","detail":"The classic path needs a vulnerable Spring web app deployed as a WAR on a standalone servlet container. Start there.","sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/","date":"2022-04-04","publisher":"Microsoft"}]},{"title":"Search for classLoader binding in requests","detail":"Look for class.module.classLoader in query strings and, where logged, POST bodies.","sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/","date":"2022-04-04","publisher":"Microsoft"}]},{"title":"Search for requests to known webshell names","detail":"Unit 42 lists 0xd0m7.jsp, myshell.jsp, shell.jsp, tomcatwar.jsp and wpz.jsp as PoC webshell file names, and saw tomcatwar.jsp used with pwd and cmd parameters.","sources":[{"url":"https://unit42.paloaltonetworks.com/cve-2022-22965-springshell/","date":"2022-03-31","publisher":"Unit 42"}]},{"title":"Sweep web roots for new JSP files","detail":"List .jsp files under webapps (especially ROOT) created or modified since 30 Mar 2022 and compare with your build artefacts.","sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/","date":"2022-04-04","publisher":"Microsoft"}]}],"queries":[{"id":"v2s-rh-spl-spring4shell-webshell-names","title":"Spring4Shell classLoader or PoC webshell requests since 30 Mar 2022","language":"spl","query":"index=* (sourcetype=access_combined OR sourcetype=tomcat* OR sourcetype=nginx* OR sourcetype=iis) earliest=\"03/30/2022:00:00:00\"\n(\"class.module.classLoader\" OR \"tomcatwar.jsp\" OR \"0xd0m7.jsp\" OR \"myshell.jsp\" OR \"wpz.jsp\" OR \"/shell.jsp\")\n| stats count min(_time) as firstTime max(_time) as lastTime values(uri) as uri values(status) as status by host, clientip\n| convert ctime(firstTime) ctime(lastTime)","logSource":"Web / Tomcat access logs in Splunk","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://unit42.paloaltonetworks.com/cve-2022-22965-springshell/","sourceDate":"2022-03-31","license":"CC0 1.0","origin":"vuln2shell","notes":"A 200 response to a webshell name with cmd= is the strongest web-log signal.","tested":"untested","timeRange":"From 2022-03-30"},{"id":"v2s-rh-kql-spring4shell-jsp-written","title":"JSP files written by java under webapps since 30 Mar 2022","language":"kql","query":"DeviceFileEvents\n| where Timestamp >= datetime(2022-03-30)\n| where InitiatingProcessFileName in~ (\"java\", \"java.exe\")\n| where FileName endswith \".jsp\"\n| where FolderPath has \"webapps\"\n| project Timestamp, DeviceName, FolderPath, FileName, SHA256, InitiatingProcessCommandLine","logSource":"Microsoft Defender for Endpoint DeviceFileEvents","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/","sourceDate":"2022-04-04","license":"CC0 1.0","origin":"vuln2shell","notes":"Legitimate deploys also write JSP; compare with deployment times.","tested":"untested","timeRange":"From 2022-03-30, limited by retention"},{"id":"v2s-rh-logscale-spring4shell-webshell-names","title":"Spring4Shell PoC webshell names in access logs","language":"logscale","query":"// Set the time picker to start 2022-03-30\n/(class\\.module\\.classLoader|tomcatwar\\.jsp|0xd0m7\\.jsp|myshell\\.jsp|wpz\\.jsp|\\/shell\\.jsp)/i\n| groupBy([#host], function=[count(), min(@timestamp, as=firstSeen), max(@timestamp, as=lastSeen)])","logSource":"Web or WAF logs in LogScale","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://unit42.paloaltonetworks.com/cve-2022-22965-springshell/","sourceDate":"2022-03-31","license":"CC0 1.0","origin":"vuln2shell","tested":"untested","timeRange":"From 2022-03-30"}],"thirdPartyQueries":[{"title":"Java Writing JSP File","url":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/endpoint/java_writing_jsp_file.yml","author":"Splunk Threat Research","date":null,"language":"spl","license":"Apache-2.0","origin":"vendor","note":"Endpoint version of the JSP-write hunt."}],"artefacts":[{"kind":"web-log","value":"class.module.classLoader.* parameters","detail":"Exploit request shape.","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/","sourceDate":"2022-04-04"},{"kind":"file","value":"0xd0m7.jsp, myshell.jsp, shell.jsp, tomcatwar.jsp, wpz.jsp under Tomcat webapps","detail":"Webshell names from public PoCs.","sourceUrl":"https://unit42.paloaltonetworks.com/cve-2022-22965-springshell/","sourceDate":"2022-03-31"},{"kind":"web-log","value":"tomcatwar.jsp?pwd=...&cmd=...","detail":"Webshell use seen in Unit 42 telemetry, including a Mirai download.","sourceUrl":"https://unit42.paloaltonetworks.com/cve-2022-22965-springshell/","sourceDate":"2022-03-31"}],"iocs":[{"type":"filename","value":"tomcatwar.jsp","context":"Most common PoC webshell name.","sourceUrl":"https://unit42.paloaltonetworks.com/cve-2022-22965-springshell/","sourceDate":"2022-03-31"}],"hitMeaning":[{"level":"attempt","detail":"classLoader parameters with a 4xx or 5xx response, or no matching file on disk."},{"level":"likely-compromise","detail":"A matching .jsp file exists in the web root, or a webshell name returns 200."},{"level":"confirmed-compromise","detail":"The webshell was called with cmd= and java spawned a shell or downloader."}],"nextSteps":[{"title":"Remove webshells and rebuild","detail":"Delete the JSP, then redeploy from a clean build after upgrading Spring Framework.","links":[{"label":"Spring advisory","href":"https://spring.io/security/cve-2022-22965"}]},{"title":"Review what ran","detail":"Use EDR or shell history to find downloaded payloads such as Mirai scripts."}],"limits":["POST bodies are not in most access logs, so the exploit request itself is often invisible.","Webshells may have been renamed; compare all JSP files with known-good builds."],"sources":[{"url":"https://unit42.paloaltonetworks.com/cve-2022-22965-springshell/","date":"2022-03-31","publisher":"Unit 42"},{"url":"https://www.microsoft.com/en-us/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/","date":"2022-04-04","publisher":"Microsoft"}],"updatedAt":"2026-10-24"},"amIAffected":{"summary":"A Spring MVC or Spring WebFlux app on JDK 9+ may be vulnerable to RCE via data binding. Spring lists Framework 5.3.0-5.3.17 and 5.2.19.RELEASE and earlier as affected, fixed in 5.3.18 and 5.2.20.RELEASE. Boot 2.6.6 and 2.5.12 pull the fixed Framework. The public Tomcat WAR exploit also needs Apache Tomcat as the servlet container and a traditional WAR. Spring says a Boot executable jar is not vulnerable to that exploit, but the issue is more general and other vectors may exist. Do not treat a Boot jar as patched.","checks":[{"id":"v2s-aia-spring4shell-version-1","kind":"version","title":"JDK version (precondition)","detail":"Spring and Microsoft list JDK 9 or higher as a prerequisite for the reported exploit. This is a precondition, not proof the app is vulnerable.","command":"java -version","affectedMeans":"Output shows Java 9 or later (for example 11, 17, 21) AND the host also runs a vulnerable Spring web dependency. JDK 9+ alone is not enough.","fixedMeans":"Spring Framework 5.3.18+ or 5.2.20+ (or Boot 2.6.6+ / 2.5.12+) is the Framework fix. A java -version of 1.8.0 is the JDK 8 last-resort workaround Spring documented on 31 Mar 2022 and 1 Apr 2022, not a Framework patch.","notes":"Spring updated the Am I Impacted text on 1 Apr and 4 Apr 2022. Typical Boot deployments with an embedded container are not impacted by the reported Tomcat WAR exploit, but Spring still tells you to upgrade.","sources":[{"url":"https://spring.io/security/cve-2022-22965","date":"2022-03-31","publisher":"Spring"},{"url":"https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement","date":"2022-03-31","publisher":"Spring"},{"url":"https://www.microsoft.com/en-us/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/","date":"2022-04-04","publisher":"Microsoft"}]},{"id":"v2s-aia-spring4shell-package-2","kind":"package","title":"Spring Framework / spring-webmvc / spring-webflux jar versions","detail":"Inventory spring-webmvc, spring-webflux, and spring-beans jars. Spring lists 5.3.0-5.3.17 and 5.2.19.RELEASE and earlier as affected. Unit 42 also notes any Java app using spring-beans-*.jar and Spring parameter binding could be in scope.","command":"find /opt /usr /var /srv /home -type f \\( -name 'spring-webmvc-*.jar' -o -name 'spring-webflux-*.jar' -o -name 'spring-beans-*.jar' -o -name 'spring-core-*.jar' \\) 2>/dev/null","affectedMeans":"Jar name or Implementation-Version is 5.3.0 through 5.3.17, or 5.2.19 or earlier, and the app uses spring-webmvc or spring-webflux.","fixedMeans":"5.3.18 or later, or 5.2.20.RELEASE or later. Boot apps should show Boot 2.6.6+ or 2.5.12+ (or a later Boot that depends on Framework 5.3.18+).","notes":"Distro or vendor-repackaged jars may not encode the version in the filename. Read META-INF/MANIFEST.MF Implementation-Version. Maven property spring-framework.version is inventory of the build, not of what is running.","sources":[{"url":"https://spring.io/security/cve-2022-22965","date":"2022-03-31","publisher":"Spring"},{"url":"https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement","date":"2022-03-31","publisher":"Spring"},{"url":"https://unit42.paloaltonetworks.com/cve-2022-22965-springshell/","date":"2022-03-31","publisher":"Unit 42"}]},{"id":"v2s-aia-spring4shell-package-3","kind":"package","title":"Spring Boot release that consumes the fixed Framework","detail":"Spring's 31 Mar 2022 early announcement released Boot 2.6.6 and 2.5.12 that depend on Framework 5.3.18.","command":"find /opt /usr /var /srv /home -type f -name 'spring-boot-*.jar' 2>/dev/null; grep -R --include='pom.xml' --include='build.gradle*' -E 'spring-boot|spring-framework.version' /opt /usr /var /srv 2>/dev/null | head","affectedMeans":"Boot 2.6.0-2.6.5 or 2.5.0-2.5.11 (or older Boot still on Framework 5.3.17 / 5.2.19 or earlier).","fixedMeans":"Boot 2.6.6 or later, or 2.5.12 or later, or a manual Framework bump to 5.3.18+ / 5.2.20+.","sources":[{"url":"https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement","date":"2022-03-31","publisher":"Spring"}]},{"id":"v2s-aia-spring4shell-config-4","kind":"config","title":"WAR on a standalone servlet container (classic exploit path)","detail":"Spring's prerequisites for the reported exploit: packaged as a traditional WAR on a standalone servlet container (Tomcat named). Typical Boot executable-jar / embedded container deployments are not impacted by that exploit. Spring still says other vectors may exist.","command":"ls -la ${CATALINA_HOME:-/usr/share/tomcat}/webapps ${CATALINA_BASE:-/var/lib/tomcat}/webapps 2>/dev/null; find /opt /var /srv -name '*.war' -o -name 'spring-boot-*.jar' 2>/dev/null | head","affectedMeans":"A Spring MVC/WebFlux WAR deployed on standalone Tomcat (or another container Spring later named as known-vulnerable) plus JDK 9+ and a vulnerable Framework version.","fixedMeans":"Framework 5.3.18+ / 5.2.20+ (preferred). A Boot executable jar without a standalone WAR is outside the reported Tomcat exploit path, but is not a substitute for upgrading Framework.","notes":"Spring 1 Apr 2022: Tomcat 10.0.19, 9.0.61, 8.5.77 and earlier are known to be vulnerable on the container side. Payara and Glassfish are also known to be vulnerable. Other servlet containers may also be vulnerable.","sources":[{"url":"https://spring.io/security/cve-2022-22965","date":"2022-03-31","publisher":"Spring"},{"url":"https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement","date":"2022-03-31","publisher":"Spring"}]},{"id":"v2s-aia-spring4shell-version-5","kind":"version","title":"Apache Tomcat version (container-side precondition / workaround)","detail":"Spring 1 Apr 2022: Tomcat 10.0.20, 9.0.62, and 8.5.78 close the attack vector on Tomcat's side. Earlier 10.0.19 / 9.0.61 / 8.5.77 and below are known vulnerable for the reported path.","command":"if [ -n \"$CATALINA_HOME\" ]; then \"$CATALINA_HOME/bin/version.sh\"; fi; dpkg-query -W -f='${Package} ${Version}\\n' 'tomcat*' 2>/dev/null; rpm -q tomcat tomcat9 2>/dev/null","affectedMeans":"Tomcat 10.0.19 / 9.0.61 / 8.5.77 or earlier, plus a vulnerable Spring WAR on JDK 9+. Tomcat version alone is not the Framework bug.","fixedMeans":"Preferred: Spring Framework 5.3.18+ or 5.2.20+. Tactical container workaround: Tomcat 10.0.20+, 9.0.62+, or 8.5.78+ as Spring documented. That is not a Framework patch.","sources":[{"url":"https://spring.io/blog/2022/04/01/spring-framework-rce-mitigation-alternative","date":"2022-04-01","publisher":"Spring"},{"url":"https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement","date":"2022-03-31","publisher":"Spring"}]}],"limits":["No sourced Shodan or Censys query string for Spring4Shell is on the catalog page or the vendor advisories fetched for this brief. Do not invent one.","Microsoft published a curl to class.module.classLoader.URLs that returns HTTP 400 on some vulnerable hosts. That is a crafted binding request, not read-only inventory. Do not use it as an Am I affected check.","A Boot executable jar is outside the reported Tomcat WAR exploit. Spring still says other vectors may exist. Do not label those hosts not affected.","Payara and Glassfish are named by Spring as known-vulnerable containers (update 8 Apr 2022 on the early announcement). Other containers may also be vulnerable.","Jar filenames can lie after vendor repacks. Prefer Implementation-Version and the running classpath."],"sources":[{"url":"https://spring.io/security/cve-2022-22965","date":"2022-03-31","publisher":"Spring"},{"url":"https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement","date":"2022-03-31","publisher":"Spring"},{"url":"https://www.microsoft.com/en-us/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/","date":"2022-04-04","publisher":"Microsoft"},{"url":"https://unit42.paloaltonetworks.com/cve-2022-22965-springshell/","date":"2022-03-31","publisher":"Unit 42"},{"url":"https://spring.io/blog/2022/04/01/spring-framework-rce-mitigation-alternative","date":"2022-04-01","publisher":"Spring"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"mitigations":{"summary":"Spring documents tactical workarounds: upgrade Tomcat, set WebDataBinder disallowedFields, or (last resort) stay on JDK 8. Prefer Framework 5.3.18 or 5.2.20.","items":[{"title":"Upgrade Tomcat (tactical, container-side)","detail":"Spring's 1 Apr 2022 mitigation-alternative post: Apache Tomcat 10.0.20, 9.0.62, and 8.5.78 close the attack vector on Tomcat's side. The 31 Mar 2022 early announcement repeats those versions under Suggested Workarounds. Prefer Framework 5.3.18+ or 5.2.20+ because that addresses the root cause and other possible vectors.","limits":"Tactical only. Does not patch Spring Framework. Spring says use it for older unsupported Framework versions and still plan a Framework upgrade. Combine with disallowedFields for defense in depth. Other servlet containers are not covered by this Tomcat upgrade.","verify":"\"$CATALINA_HOME/bin/version.sh\" or the distro package query. Affected-side: 10.0.19 / 9.0.61 / 8.5.77 or earlier. Workaround in place: 10.0.20+, 9.0.62+, or 8.5.78+.","source":{"url":"https://spring.io/blog/2022/04/01/spring-framework-rce-mitigation-alternative","date":"2022-04-01","publisher":"Spring"}},{"title":"Set WebDataBinder disallowedFields for class / Class","detail":"Spring's 31 Mar 2022 Suggested Workarounds: set disallowedFields on WebDataBinder globally to class.*, Class.*, *.class.*, *.Class.* via @ControllerAdvice @InitBinder, or the fail-safe RequestMappingHandlerAdapter / WebMvcRegistrations extension so a local @InitBinder cannot override the denylist. Microsoft 4 Apr 2022 republished the same denylist.","limits":"Spring says a controller that sets disallowedFields locally can override the global setting. The simple @ControllerAdvice form may leave loopholes. Spring 13 Apr 2022 published CVE-2022-22968 because disallowedFields matching was case-sensitive on 5.3.0-5.3.18 and 5.2.0-5.2.20; they released Framework 5.3.19 and 5.2.21 to ignore case. If you keep this workaround, Spring says update to 5.3.19+ / 5.2.21+ and reassess data-binding design. This is not a substitute for 5.3.18+ / 5.2.20+ on the RCE itself.","verify":"Read-only code search: grep -R --include='*.java' -E 'setDisallowedFields|class\\.\\*|BinderControllerAdvice|GlobalControllerAdvice' . Confirm the four patterns are registered and that no controller @InitBinder replaces them. After CVE-2022-22968, confirm Framework 5.3.19+ or 5.2.21+ if you still rely on this workaround.","source":{"url":"https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement","date":"2022-03-31","publisher":"Spring"}},{"title":"Downgrade to JDK 8 (last resort)","detail":"Spring 31 Mar 2022 (updated 1 Apr 2022) and the 1 Apr 2022 mitigation-alternative post: downgrading to Java 8 is a viable workaround if you can neither upgrade Framework nor Tomcat. Microsoft 4 Apr 2022 points at Spring's workaround set.","limits":"Last resort. Loses JDK 9+ language and runtime features. Trend Micro 8 Apr 2022 notes a JDK 8 downgrade might help but could impact features and reopen issues fixed in later JDKs. Does not patch Framework. Prefer 5.3.18+ / 5.2.20+.","verify":"java -version shows 1.8.x. Confirm the running Tomcat/app process is that same JDK (read /proc/<pid>/exe or the service Environment). A leftover JDK 11+ for the app server means the workaround is not in effect.","source":{"url":"https://spring.io/blog/2022/04/01/spring-framework-rce-mitigation-alternative","date":"2022-04-01","publisher":"Spring"}}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"response":{"summary":"Isolate the servlet host and hunt unexpected JSP files under Tomcat webapps. Microsoft and Unit 42 describe webshells written after successful exploitation.","containment":[{"title":"Take the Spring WAR off the network or block the app until patched","detail":"The reported exploit is unauthenticated HTTP to a data-binding endpoint, then a JSP written under a web-accessible directory. Isolate the Tomcat/servlet host or the reverse-proxy route for that WAR before you hunt disks.","generic":true},{"title":"Stop serving unexpected JSP under webapps","detail":"Microsoft 4 Apr 2022 and Unit 42 31 Mar 2022 describe the exploit writing a JSP webshell under the Tomcat web application directory (often ROOT). Remove or quarantine unexpected .jsp, then redeploy from a clean build after Framework upgrade.","sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/","date":"2022-04-04","publisher":"Microsoft"},{"url":"https://unit42.paloaltonetworks.com/cve-2022-22965-springshell/","date":"2022-03-31","publisher":"Unit 42"}]}],"rotate":[{"item":"Application secrets the Tomcat / Java process user can read (datasource passwords, API keys, cloud credentials in the WAR or environment)","reason":"Successful exploitation runs code as the application server user. Microsoft 4 Apr 2022: once the JSP is in place the attacker executes commands as Tomcat. Treat anything that account can read as exposed.","generic":true,"sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/","date":"2022-04-04","publisher":"Microsoft"}]},{"item":"OS accounts and SSH keys on the same host if a webshell ran a shell or downloader","reason":"Unit 42 saw webshells used for whoami, cat /etc/passwd, and a Mirai download. Trend Micro 8 Apr 2022 saw wget into /tmp and chmod then execute. If those commands ran, assume local credentials and any keys the Tomcat user could read are in scope.","sources":[{"url":"https://unit42.paloaltonetworks.com/cve-2022-22965-springshell/","date":"2022-03-31","publisher":"Unit 42"},{"url":"https://www.trendmicro.com/en_us/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html","date":"2022-04-08","publisher":"Trend Micro"}]}],"persistence":[{"kind":"webshell","value":"tomcatwar.jsp under Tomcat webapps (often webapps/ROOT)","detail":"Most common PoC webshell name. Unit 42: tomcatwar.jsp used with pwd and cmd. Trend Micro: prefix tomcatwar, suffix .jsp, directory webapps/ROOT. Unit 42 later saw tomcatwar.jsp used to wget a Mirai script.","sourceUrl":"https://unit42.paloaltonetworks.com/cve-2022-22965-springshell/","sourceDate":"2022-03-31"},{"kind":"webshell","value":"shell.jsp in the Tomcat root / web application directory","detail":"Microsoft 4 Apr 2022: the public POC writes a password-protected webshell called shell.jsp in the Tomcat root directory. Trend Micro also names shell.jsp in unsuccessful-create log examples.","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/","sourceDate":"2022-04-04"},{"kind":"webshell","value":"0xd0m7.jsp, myshell.jsp, wpz.jsp (and other PoC names) under Tomcat webapps","detail":"Unit 42 lists 0xd0m7.jsp, myshell.jsp, shell.jsp, tomcatwar.jsp, wpz.jsp as filenames that would store webshell contents on success. They later listed 95 unique names from packet captures; many were scanner markers (.txt, .js) rather than working JSPs.","sourceUrl":"https://unit42.paloaltonetworks.com/cve-2022-22965-springshell/","sourceDate":"2022-03-31"},{"kind":"path","value":"/usr/local/tomcat/webapps/ROOT/shell_.jsp and /usr/local/tomcat/work/Catalina/localhost/ROOT/org/apache/jsp/shell_jsp.java","detail":"Unit 42 Cortex XDR alerts 4-8 Apr 2022 included these write paths. Unit 42 says a majority of those alerts were testing of public PoC tools and docker containers named spring4shell.","sourceUrl":"https://unit42.paloaltonetworks.com/cve-2022-22965-springshell/","sourceDate":"2022-03-31"},{"kind":"path","value":"/tmp plus chmod-then-execute of a downloaded binary (Mirai)","detail":"Trend Micro 8 Apr 2022: after tomcatwar.jsp, actors ran cd /tmp; wget a Mirai sample; chmod 777 *; execute. Activity from the start of April 2022. Unit 42 also saw tomcatwar.jsp used to wget t.sh (Mirai) into a shell.","sourceUrl":"https://www.trendmicro.com/en_us/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html","sourceDate":"2022-04-08"}],"evidence":[{"title":"HTTP access / WAF logs for class.module.classLoader binding","detail":"Microsoft documents requests that touch class.module.classLoader properties (for example class.module.classLoader.URLs and class.module.classLoader.resources.context.parent.pipeline.first.*). Preserve access logs and WAF events from at least 30 Mar 2022 (Unit 42 first scan date).","sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/","date":"2022-04-04","publisher":"Microsoft"},{"url":"https://unit42.paloaltonetworks.com/cve-2022-22965-springshell/","date":"2022-03-31","publisher":"Unit 42"}]},{"title":"Requests to known webshell names with pwd / cmd / id","detail":"Unit 42: tomcatwar.jsp?pwd=...&cmd=... and a second variant using id. Preserve 200 responses to those names. Microsoft Sentinel hunting looks for .jsp?cmd=.","sources":[{"url":"https://unit42.paloaltonetworks.com/cve-2022-22965-springshell/","date":"2022-03-31","publisher":"Unit 42"},{"url":"https://www.microsoft.com/en-us/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/","date":"2022-04-04","publisher":"Microsoft"}]},{"title":"File listing of webapps and Tomcat work/ before rebuild","detail":"Image or copy webapps (especially ROOT) and work/Catalina compiled JSP trees before deleting shells. Compare create times to 30 Mar 2022 onward.","generic":true,"sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/","date":"2022-04-04","publisher":"Microsoft"}]},{"title":"EDR process tree: java spawning sh, bash, wget, curl, chmod","detail":"Trend Micro and Unit 42 document post-webshell downloaders. Microsoft EDR title: Suspicious process executed by a network service. Preserve process telemetry and /tmp artefacts.","sources":[{"url":"https://www.trendmicro.com/en_us/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html","date":"2022-04-08","publisher":"Trend Micro"}]}],"sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/","date":"2022-04-04","publisher":"Microsoft"},{"url":"https://unit42.paloaltonetworks.com/cve-2022-22965-springshell/","date":"2022-03-31","publisher":"Unit 42"},{"url":"https://www.trendmicro.com/en_us/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html","date":"2022-04-08","publisher":"Trend Micro"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"bulletins":[{"vendor":"Akamai","title":"Mitigating Spring Core 'Spring4Shell' Zero-Day","url":"https://www.akamai.com/blog/security/spring-core-spring4shell-zero-day","date":"2022-03-31","cve":"CVE-2022-22965"},{"vendor":"Azure","title":"Application Gateway WAF DRS and CRS rule groups and rules","url":"https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules","date":"2026-10-23","cve":"CVE-2022-22965"},{"vendor":"Check Point","title":"CPAI-2022-0104 Spring Core Remote Code Execution (CVE-2022-22965)","url":"https://advisories.checkpoint.com/defense/advisories/public/2022/cpai-2022-0104.html","date":"2022-03-31","cve":"CVE-2022-22965"},{"vendor":"Cisco Talos","title":"Threat Advisory: Spring4Shell","url":"https://blog.talosintelligence.com/threat-advisory-spring4shell/","date":"2022-03-31","cve":"CVE-2022-22965"},{"vendor":"Citrix","title":"NetScaler signature update version 79","url":"https://docs.netscaler.com/en-us/citrix-adc/13-1/signature-alerts/signature-update-version-79.html","date":"2026-10-23","cve":"CVE-2022-22965","dateKind":"checked"},{"vendor":"Citrix","title":"NetScaler signature update version 80","url":"https://docs.netscaler.com/en-us/citrix-adc/13-1/signature-alerts/signature-update-version-80.html","date":"2026-10-23","cve":"CVE-2022-22965","dateKind":"checked"},{"vendor":"Cloudflare","title":"Cloudflare WAF mitigations for Spring4Shell","url":"https://blog.cloudflare.com/waf-mitigations-spring4shell/","date":"2022-03-31","cve":"CVE-2022-22965"},{"vendor":"Fastly","title":"Added virtual patches for CVE-2022-22963 and CVE-2022-22965","url":"https://www.fastly.com/documentation/reference/changes/2022/03/added-virtual-patches-for-cve-2022-22963-and-cve-2022-22965/","date":"2022-03-31","cve":"CVE-2022-22965"},{"vendor":"Fortinet","title":"FortiGuard search: CVE-2022-22965","url":"https://www.fortiguard.com/search?q=CVE-2022-22965&engine=1","date":"2022-03-31","cve":"CVE-2022-22965"},{"vendor":"Fortinet","title":"FortiGuard Outbreak Alert: Spring4Shell Vulnerability","url":"https://www.fortiguard.com/outbreak-alert/spring4shell-vulnerability","date":"2026-10-23","cve":"CVE-2022-22965","dateKind":"checked"},{"vendor":"Imperva","title":"Imperva protects from new Spring Framework zero-day vulnerabilities","url":"https://www.imperva.com/blog/imperva-protects-from-new-spring-framework-zero-day-vulnerabilities/","date":"2022-03-31","cve":"CVE-2022-22965"},{"vendor":"Juniper","title":"HTTP:CTS:VMWR-SPRING-CORE-RCE","url":"https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.HTTP:CTS:VMWR-SPRING-CORE-RCE.html","date":"2022-03-31","cve":"CVE-2022-22965"},{"vendor":"Netskope","title":"Two RCE vulnerabilities found in Spring Framework","url":"https://threatlabs.netskope.com/blog/2022/04/two-rce-vulnerabilities-found-in-spring-framework/","date":"2022-04-06","cve":"CVE-2022-22965"},{"vendor":"Palo Alto Networks","title":"CVE-2022-22965: SpringShell RCE vulnerability analysis and mitigations","url":"https://unit42.paloaltonetworks.com/cve-2022-22965-springshell/","date":"2022-03-31","cve":"CVE-2022-22965"},{"vendor":"Trend Micro","title":"SECURITY ALERT: Spring Framework 'Spring4Shell' RCE via Data Binding Vulnerability (CVE-2022-22965)","url":"https://success.trendmicro.com/en-US/solution/KA-0012910","date":"2026-10-23","cve":"CVE-2022-22965","dateKind":"checked"},{"vendor":"Zscaler","title":"Spring Cloud Framework vulnerabilities analysis","url":"https://www.zscaler.com/blogs/security-research/analysis-spring-cloud-framework-vulnerabilities","date":"2022-03-31","cve":"CVE-2022-22965"}],"coverage":[{"title":"Spring Framework RCE via Data Binding on JDK 9+","publisher":"Spring","url":"https://spring.io/security/cve-2022-22965","date":"2022-03-31","type":"vendor"},{"title":"Spring Framework RCE, Early Announcement","publisher":"Spring","url":"https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement","date":"2022-03-31","type":"vendor"},{"title":"CVE-2022-22965 SpringShell","publisher":"Unit 42","url":"https://unit42.paloaltonetworks.com/cve-2022-22965-springshell/","date":"2022-03-31","type":"research"},{"title":"SpringShell RCE vulnerability guidance","publisher":"Microsoft","url":"https://www.microsoft.com/en-us/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/","date":"2022-04-04","type":"research"},{"title":"Analyzing the Exploitation of Spring4Shell Vulnerability in Weaponizing Mirai","publisher":"Trend Micro","url":"https://www.trendmicro.com/en_us/research/22/d/cve-2022-22965-analyzing-the-exploitation-of-spring4shell-vulner.html","date":"2022-04-01","type":"research"}],"posts":[],"research":[{"title":"Spring CVE-2022-22965","url":"https://spring.io/security/cve-2022-22965","authors":"Spring / VMware","date":"2022-03-31"},{"title":"Spring early announcement","url":"https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement","authors":"Rossen Stoyanchev","date":"2022-03-31"},{"title":"NVD CVE-2022-22965","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22965","authors":"NVD","date":"2022-04-01"},{"title":"Unit 42 SpringShell analysis","url":"https://unit42.paloaltonetworks.com/cve-2022-22965-springshell/","authors":"Unit 42","date":"2022-03-31"},{"title":"Microsoft SpringShell guidance","url":"https://www.microsoft.com/en-us/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/","authors":"Microsoft","date":"2022-04-04"}],"impact":{"kind":"framework","frameworks":[{"framework":"Spring Framework 5.3.x","status":"affected","versions":"5.3.18","vendorStatement":{"date":"2022-03-31","url":"https://spring.io/security/cve-2022-22965","quote":"Affected: 5.3.0 - 5.3.17. Fix version 5.3.18 (OSS)."}},{"framework":"Spring Framework 5.2.x and earlier","status":"affected","versions":"5.2.20.RELEASE","vendorStatement":{"date":"2022-03-31","url":"https://spring.io/security/cve-2022-22965","quote":"Affected: 5.2.19.RELEASE and earlier. Fix version 5.2.20.RELEASE (OSS)."}},{"framework":"Spring Boot 2.6.x","status":"affected","versions":"2.6.6","vendorStatement":{"date":"2022-03-31","url":"https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement","quote":"Spring Boot 2.6.6 that depend on Spring Framework 5.3.18 have been released."}},{"framework":"Spring Boot 2.5.x","status":"affected","versions":"2.5.12","vendorStatement":{"date":"2022-03-31","url":"https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement","quote":"Spring Boot 2.5.12 that depend on Spring Framework 5.3.18 have been released."}},{"framework":"Apache Tomcat (mitigation path)","status":"affected","versions":"10.0.20 / 9.0.62 / 8.5.78","vendorStatement":{"date":"2022-04-01","url":"https://spring.io/blog/2022/04/01/spring-framework-rce-mitigation-alternative","quote":"Apache Tomcat has released versions 10.0.20, 9.0.62, and 8.5.78 which close the attack vector on Tomcat's side."}}]},"pocs":[{"title":"Spring4Shell-POC (dockerized app + exploit)","url":"https://github.com/reznok/Spring4Shell-POC","source":"reznok","validationStatus":"validated","validationDate":"2022-03-31","notes":"Public repository created 31 Mar 2022. Description: Dockerized Spring4Shell (CVE-2022-22965) PoC application and exploit."}],"_feed":{"page":"https://vuln2shell.com/vulns/spring4shell","json":"https://vuln2shell.com/vulns/spring4shell.json","iocsCsv":"https://vuln2shell.com/vulns/spring4shell/iocs.csv","stix":"https://vuln2shell.com/vulns/spring4shell/stix.json"}}