TTP Tuesday: Is CVE-2022-22965 patched on this host?
CVE-2022-22965 (Spring4Shell): Remote code execution in Spring Framework.
This week, we are releasing two TTPs:
Is CVE-2022-22965 patched on this host?
Is this host protected from Maui ransomware?
Is CVE-2022-22965 patched on this host?
A remote code execution vulnerability was confirmed in Spring Framework, the most popular Java framework used to build server-side apps.
On March 31st, a researcher released a proof-of-concept (POC) attack that could remotely upload a web shell to a server running Spring Framework, revealing a major remote code execution vulnerability. This poses a significant danger to enterprises since a vulnerability like this might allow an attacker to seize control of the affected server.
Web shells can allow a threat actor to hijack web servers and execute further assaults. Threat actors can also infiltrate a system or network before installing a web shell, they can then utilize the web shell as a permanent backdoor into the compromised systems.
Spring Framework versions prior to 5.3.18 are vulnerable to remote code execution.
Testing
Execute Operator’s CVE-2022-22965 TTP on each host running Spring Framework in your environment to test if you are vulnerable.
The TTP is configured to upload a web shell to the machine, run a command, and check for a specific output. If the output is successful then it'll delete the web shell completely, removing the web shell artifact from your system.
Remediation
Upgrade Spring Framework to version 5.3.18 or above. Spring has published a security advisory with instructions for patching and mitigating this vulnerability.
Is this host protected from Maui ransomware?
Maui ransomware has been used by North Korean state-sponsored actors since at least May 2021 according to a CISA advisory released in July 2022. This ransomware has been used in attacks targeting the public health care sector.
Testing
This TTP uses a defanged (non-malicious) version of Maui which is executed on the local host. Detection opportunities on the host occur during the malware download, writing the malware to disk, and execution of the defanged malware.
Remediation
Modify your endpoint detection rules to alert on the following behaviors: file download, file write, execution of the defanged Maui version
Check out “Is CVE-2022-22965 patched on Spring Framework?” on the Prelude chains website.
Staying up to date
Thanks for reading our latest TTP Tuesday release! Please subscribe and reach out with any feedback. We love to hear from our community!
There are several ways to follow us and learn more about Prelude and our team members:
Get our products
Download Prelude Operator: https://www.prelude.org/download
See the latest kill chain and TTP Releases:
https://chains.prelude.org
See our open-source repositories: https://github.com/preludeorg
Join our community
Discord: https://discord.gg/gzUv4XNquu
Reddit: https://www.reddit.com/r/preludeorg/
Twitter: https://twitter.com/preludeorg
Read, watch, and listen
Listen to our Podcast: https://anchor.fm/preludeorg
Read our blog: https://feed.prelude.org
Watch our live streams: https://www.twitch.tv/preludeorg
Watch our pre-recorded content: https://www.youtube.com/c/preludeorg
Follow our team
David: https://twitter.com/privateducky
Alex: https://twitter.com/khyberspache
Kris: https://twitter.com/Xanthonus
Octavia: https://twitter.com/VV_X_7
Bart: https://twitter.com/bartimusprimed
Sam: https://twitter.com/ghostOrchad