CVE-2022-22965 PoC — Spring Framework 代码注入漏洞

Source

https://github.com/Nosie12/fire-wall-server

Associated Vulnerability

Title:Spring Framework 代码注入漏洞 (CVE-2022-22965)
Description:A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

Description

Python-based simulated firewall to detect and block Spring4Shell (CVE-2022-22965) exploit attempts. This project filters HTTP requests by identifying malicious payload patterns using a custom firewall_server.py and tests them with test_requests.py.

Readme

# 🛡️ Spring4Shell Firewall Mitigation (Python Script)

This project simulates a firewall using Python's built-in `http.server` module to detect and block malicious requests exploiting the **Spring4Shell (CVE-2022-22965)** vulnerability.

## 🔍 About

Spring4Shell is a critical Remote Code Execution (RCE) vulnerability affecting Spring Core Framework. Attackers use malicious payloads to deploy web shells on servers. This repo demonstrates how to block these using a lightweight custom Python HTTP firewall.

## 🚀 Features

- Detects and blocks known Spring4Shell payloads
- Pattern matching against:
  - Dangerous URL path: `/tomcatwar.jsp`
  - Exploit parameters like `class.module.classLoader.resources.context.parent.pipeline`
  - Encoded payloads: `%7Bc1%7D`, `%7Bc2%7D`
- Responds with `403 Forbidden` if malicious

File Snapshot


 [4.0K]  /data/pocs/997c944663b83d3fe1ab30d8f1d3f99120034578
├── [1.5K]  firewall_server.py
└── [ 834]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!