Spring4Shell
ID |
spring4shell |
Severity |
critical |
Kind |
Remote Code Execution |
CWE |
78 |
Description
The application appears to be vulnerable to CVE-2022-22965 (otherwise known as Spring4Shell) - remote code execution (RCE) via data binding.
Rationale
Spring4Shell exploits unsafe data binding in Spring Framework to achieve remote code execution without authentication. Attackers manipulate request parameters to access Java class properties and modify application classloader settings, ultimately writing malicious JSP files to the web root. This allows complete server takeover, enabling attackers to steal data, install backdoors, pivot to internal networks, or deploy ransomware.