Spring Framework Remote Code Execution (CVE-2022-22965)

Details of a zero-day vulnerability in Spring Framework were leaked on March 29, 2022 but promptly taken down by the original source. Although much of the initial speculation about the nature of the vulnerability was incorrect, we now know that the vulnerability has the potential to be quite serious depending on your organization’s use of Spring Framework. There is also a dedicated CVE 2022-22965 assigned to this vulnerability. 
We will keep this blog updated as new information comes up.  
Technical summary 
The cause was initially rumored to be related to deserialization, but the actual cause is due to unforeseen access to Tomcat’s ClassLoader as a result of the new Module feature added in Java 9. An existing mitigation only blocked access to the classLoader property of Class objects, but the new Module object also has a classLoader property and was therefore accessible through Spring’s property bindings when a Java object is bound to a request parameter. 
Access to the classLoader…

SecRule REQUEST_URI "@rx ..." "id:1001,phase:1,deny,status:403"

find /var/www -type f -name "*.php" -mmin -120

ss -tunp | grep -E ":(4444|1337|8080|9001)"

apt update && apt --only-upgrade install <pkg>

title: Detect Exploitation - Spring Framework Remote Code Execution (CVE-2022-22965)
id: a3af1850-7340-479e-a59b-5eab08b47499
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
  - attack.t1190

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "Spring Framework Remote Code E" ascii wide
    condition:
        any of them
}