{"id":103660,"date":"2022-03-31T09:36:38","date_gmt":"2022-03-31T07:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kriticheskaya-0-day-uyazvimost-v-spring-framework-primenyaemom-vo-mnogih-java-proektah"},"modified":"2022-03-31T09:36:38","modified_gmt":"2022-03-31T07:36:38","slug":"kriticheskaya-0-day-uyazvimost-v-spring-framework-primenyaemom-vo-mnogih-java-proektah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/kriticheskaya-0-day-uyazvimost-v-spring-framework-primenyaemom-vo-mnogih-java-proektah","title":{"rendered":"Critical 0-day vulnerability in the Spring Framework used in many Java projects","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A critical 0-day vulnerability has been discovered in the Spring Core module, part of the Spring Framework, allowing unauthenticated remote attackers to execute their code on the server. It is currently unclear how catastrophic the consequences of this vulnerability could be and whether the attacks will be as widespread as those related to the Log4j 2 vulnerability. The vulnerability has been given the code name Spring4Shell, but a CVE identifier has not yet been assigned. The issue remains unpatched in the Spring Framework, and several working prototype exploits are already available online (1, 2, 3, 4). The problem is exacerbated by the fact that many enterprise Java applications based on the Spring Framework run with root privileges, and this vulnerability allows for full system compromise. <\/p>\n
According to some estimates, the Spring Core module is used in 74% of Java applications. The danger of this vulnerability is mitigated by the fact that only applications using the @RequestMapping annotation for linking request handlers and binding parameters in the format 'name=value' (POJO, Plain Old Java Object) are affected, rather than those using JSON\/XML. <\/p>\n
It is still unclear which specific Java applications and frameworks are susceptible to this issue. The vulnerability prevents adding 'class', 'module', and 'classLoader' fields to the blacklist or using an explicit whitelist of allowed fields. Exploitation of the vulnerability is only possible with Java\/JDK 9 or higher versions. This problem is caused by the ability to bypass the protection against the CVE-2010-1622 vulnerability, which was fixed in the Spring Framework back in 2010 and relates to the execution of the classLoader handler when parsing request parameters. <\/p>\n
The exploit works by sending a request with the parameters 'class.module.classLoader.resources.context.parent.pipeline.first.*', the processing of which results in the creation of a JSP file in the root environment of Apache Tomcat, with the specified attack code written into that file. The created file becomes accessible for direct requests and can be used as a web shell. To attack a vulnerable application in an Apache Tomcat environment, it is sufficient to send a request with specific parameters using the curl utility. curl -v -d 'class.module.classLoader.resources.context.parent.pipeline.first.pattern=code_to_insert_into_file&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp&class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps\/ROOT&class.module.classLoader.resources.context.parent.pipeline.first.prefix=tomcatwar&class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat=' http:\/\/localhost:8080\/springmvc5-helloworld-exmaple-0.0.1-SNAPSHOT\/rapid7 <\/p>\n
The issue in Spring Core should not be confused with the recently discovered vulnerabilities CVE-2022-22963 and CVE-2022-22950. The first issue affects the Spring Cloud package and has been addressed in releases 3.1.7 and 3.2.3. The second issue is present in Spring Expression and has been fixed in Spring Framework 5.3.17. These are fundamentally different vulnerabilities. The Spring Framework developers have not yet made any statements regarding the new vulnerability and have not published a fix. <\/p>\n
As a temporary measure for protection, it is recommended to use a blacklist of disallowed request parameters in the code: import org.springframework.core.Ordered; import org.springframework.core.annotation.Order; import org.springframework.web.bind.WebDataBinder; import org.springframework.web.bind.annotation.ControllerAdvice; import org.springframework.web.bind.annotation.InitBinder; @ControllerAdvice @Order(10000) public class BinderControllerAdvice { @InitBinder public void setAllowedFields(WebDataBinder dataBinder) { String[] denylist = new String[]{'class.', 'Class.', '.class.', '.Class.'}; dataBinder.setDisallowedFields(denylist); } } \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"