TTP Tuesday: Is CVE-2022-22965 patched on this host?

CVE-2022-22965 (Spring4Shell): Remote code execution in Spring Framework.

This week, we are releasing two TTPs:

• Is CVE-2022-22965 patched on this host?

• Is this host protected from Maui ransomware?

Is CVE-2022-22965 patched on this host?

A remote code execution vulnerability was confirmed in Spring Framework, the most popular Java framework used to build server-side apps.

On March 31st, a researcher released a proof-of-concept (POC) attack that could remotely upload a web shell to a server running Spring Framework, revealing a major remote code execution vulnerability. This poses a significant danger to enterprises since a vulnerability like this might allow an attacker to seize control of the affected server.

Web shells can allow a threat actor to hijack web servers and execute further assaults. Threat actors can also infiltrate a system or network before installing a web shell, they can then utilize the web shell as a permanent backdoor into the compromised systems.

Spring Framework versions prior to 5.3.18 are vulnerable to remote code execution.

Testing

Execute Operator’s CVE-2022-22965 TTP on each host running Spring Framework in your environment to test if you are vulnerable.

The TTP is configured to upload a web shell to the machine, run a command, and check for a specific output. If the output is successful then it'll delete the web shell completely, removing the web shell artifact from your system.

Remediation

Upgrade Spring Framework to version 5.3.18 or above. Spring has published a security advisory with instructions for patching and mitigating this vulnerability.

Is this host protected from Maui ransomware?

Maui ransomware has been used by North Korean state-sponsored actors since at least May 2021 according to a CISA advisory released in July 2022.  This ransomware has been used in attacks targeting the public health care sector.

Testing

This TTP uses a defanged (non-malicious) version of Maui which is executed on the local host. Detection opportunities on the host occur during the malware download, writing the malware to disk, and execution of the defanged malware.

Remediation

Modify your endpoint detection rules to alert on the following behaviors: file download, file write, execution of the defanged Maui version

Check out “Is CVE-2022-22965 patched on Spring Framework?” on the Prelude chains website.

---

Staying up to date

Thanks for reading our latest TTP Tuesday release! Please subscribe and reach out with any feedback. We love to hear from our community!

There are several ways to follow us and learn more about Prelude and our team members:

Get our products

Download Prelude Operator: https://www.prelude.org/download
See the latest kill chain and TTP Releases:

https://chains.prelude.org
See our open-source repositories: https://github.com/preludeorg

Join our community

Discord: https://discord.gg/gzUv4XNquu
Reddit: https://www.reddit.com/r/preludeorg/
Twitter: https://twitter.com/preludeorg

Read, watch, and listen

Listen to our Podcast: https://anchor.fm/preludeorg
Read our blog: https://feed.prelude.org
Watch our live streams: https://www.twitch.tv/preludeorg
Watch our pre-recorded content: https://www.youtube.com/c/preludeorg

Follow our team

David: https://twitter.com/privateducky
Alex: https://twitter.com/khyberspache
Kris: https://twitter.com/Xanthonus
Octavia: https://twitter.com/VV_X_7
Bart: https://twitter.com/bartimusprimed
Sam: https://twitter.com/ghostOrchad