Skip to content
attack.paths
Anmelden
← RegistryDossier · 6 steps · 5 edges

Spring4Shell (CVE-2022-22965) → JSP webshell on Tomcat

Send a crafted POST that uses Spring's data-binding to mutate Tomcat's logging configuration — turn its access log into a JSP file written under webapps/, then request it.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: target runs Spring MVC + Apache Tomcat. Spring framework < 5.3.18 / 5.2.20. JDK 9+ (the binding chain that reaches PropertyDescriptor is JDK-9+ only).

§ Steps

  1. 01
    Request webshell from /shell.jspExecution
    T1059— Command and Scripting Interpreter
  2. 02
    Recover service creds from app config / envCredential Access
    T1552— Unsecured Credentials
  3. 03
    Identify Spring + TomcatReconnaissance
    W-RECON-FINGERPRINT— Tech Stack Fingerprinting
  4. 04
    Trigger log line containing JSP webshellPersistence
    W-WEBSHELL— Webshell Deployment
  5. 05
    Rewrite Tomcat AccessLogValve via SpringExecution
    CVE-SPRING4SHELL— Spring4Shell (CVE-2022-22965)
  6. 06
    Confirm binding reaches class.module.classLoaderExecution
    CVE-SPRING4SHELL— Spring4Shell (CVE-2022-22965)

§ References

§ Frequently asked

What is the "Spring4Shell (CVE-2022-22965) → JSP webshell on Tomcat" attack path?
Send a crafted POST that uses Spring's data-binding to mutate Tomcat's logging configuration — turn its access log into a JSP file written under webapps/, then request it. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Request webshell from /shell.jsp (T1059) — a execution primitive. Assumed environment: target runs Spring MVC + Apache Tomcat.
What is the final impact of this kill-chain?
The final step lands on Confirm binding reaches class.module.classLoader (CVE-SPRING4SHELL), which falls under Execution. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers