Spring - RCE (CVE-2022-22965)

CVE-2022-22965 is a critical remote code execution vulnerability impacting certain Spring MVC and Spring WebFlux applications through insecure data binding on Java 9 and newer environments. Applications deployed as Tomcat WAR files are particularly at risk to this type of attack.

CrowdSec has been tracking this vulnerability and its exploits since 9th of April 2022.

CrowdSec network data shows that most actors exploiting CVE-2022-22965 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2022-22965. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Observed attacks typically attempt to exploit applications running in susceptible Java environments through maliciously crafted web requests targeting WAR deployments.