31 lines
1.1 KiB
YAML
31 lines
1.1 KiB
YAML
cve: CVE-2022-22965
|
|
alias: Spring4Shell — DataBinder classLoader traversal
|
|
cwe_primary: CWE-915
|
|
cwe_acceptable: [CWE-915, CWE-94, CWE-470, CWE-913, CWE-20, CWE-913, CWE-1336]
|
|
target_file: source.java
|
|
vuln_lines: [27, 28, 29, 30, 35, 36, 37, 38, 39, 40, 41]
|
|
severity: critical
|
|
vuln_class: improper_property_binding
|
|
exploit_pattern_regex: 'class\.module\.classLoader|classLoader\.resources|AccessLogValve|\.classLoader\.'
|
|
must_mention_any:
|
|
- classloader
|
|
- class loader
|
|
- introspect
|
|
- nested property
|
|
- getClass
|
|
- allowlist
|
|
- filter
|
|
- tomcat
|
|
- accesslogvalve
|
|
- jsp
|
|
points: 30
|
|
notes: |
|
|
Vulnerability: setNestedProperty traverses ANY dotted path through bean
|
|
introspection without filtering forbidden navigations like "class.module.
|
|
classLoader" — letting attacker reach Tomcat AccessLogValve and write
|
|
a JSP webshell to the server filesystem.
|
|
Hunter MUST identify:
|
|
1. Untrusted parameter name flows into bean traversal.
|
|
2. No allowlist/denylist on traversal targets (class/classLoader/module).
|
|
3. The result is arbitrary property write → RCE primitive.
|