LABCVE-2022-22965 Spring4Shell: Emulation and Detection
In this lab, you’ll practice attacking and defending against the Spring4Shell (CVE-2022-22965) vulnerability. When you’re finished, you’ll have a thorough understanding of how the exploit works, and how it can be detected.
Terms and conditions apply.
Challenge
Getting Started in the Lab Environment
Here are the initial instructions and explanation of the lab environment. Read this while your environment is busy creating itself from nothing. Yes, this violates physics; we know. How fun!
Challenge
Emulation
In this challenge, you will be provided with an environment containing a web application vulnerable to CVE-2022-22965. You will walk through the steps required to identify Spring4Shell and build out a proof of concept to exploit the vulnerability in order to create and interface with a web shell. The learner will conceptually understand the root cause of Spring4Shell, as well as how to exploit the vulnerability and gain remote code execution on a vulnerable remote system via a web shell.
Challenge
Detection
In this challenge, you will access and analyze the log files of the reverse proxy web application serving the Tomcat application vulnerable to CVE-2022-22965 Spring4Shell. Due to the (known) exploitation requirements of the vulnerability, Spring4Shell abuse requires the use of specific strings and inputs, which can be used to identify attempted and successful exploitation - and thereafter analyze the activities the attacker performed. You will understand how to identify Spring4Shell exploitation in log files, and understand how to analyze the actions the attacker performed via the web server.
Challenge
Protection
In this challenge, you will examine and implement mechanisms to protect against CVE-2022-22965. The formal and correct solution of upgrading the vulnerable software will be discussed, and an alternative method of using a web application firewall at the ingress edge will be demonstrated (which has defense in depth merits, for example in a large organization where patching is difficult, assets are unknown, 3rd party applications are in use, or an immediate response to a new vulnerability is required). You will understand how to implement a web application firewall with a custom ruleset to identify and protect against new, or unknown vulnerabilities (in this specific case, CVE-2022-22965).
Challenge
The Last Challenge
Welcome to the final challenge! This is your last chance to experiment in the environment. Clicking Finish Lab will end this little world that flittered into existence just for you.
Provided environment for hands-on practice
We will provide the credentials and environment necessary for you to practice right within your browser.
Guided walkthrough
Follow along with the author’s guided walkthrough and build something new in your provided environment!
Did you know?
On average, you retain 75% more of your learning if you get time for practice.
Recommended prerequisites
- Linux command line tools (such as grep, less, vim, and curl)
- Understanding of Docker
- Understanding of reverse proxies