CVE-2022-22965

An Nmap NSE script that probes for the Spring Framework RCE known as CVE-2022-22965 by sending a crafted GET request and watching for a 400 response.

This repository holds a single Nmap NSE script written to detect the existence of CVE-2022-22965, a remote code execution vulnerability in Spring Framework 5.2.x and 5.3.x. The check sends a GET request with a payload that targets the class loader defined packages parameter, and treats a 400 status code as the sign that the vulnerable code path is present. The README labels the approach non-intrusive, meaning it observes the response rather than executing anything.

The payload is a URL query string, shown in the README as a class loader defined packages parameter appended to a GET request, and the whole method comes down to request, look at the code, move on. Being non-intrusive is the point: the script is meant for administrators and testers to find out whether a Spring application exposes the vulnerable configuration, not to exercise it. The 400 status code is the indicator, and nothing beyond that response is expected or acted on. The README keeps the explanation to a few lines and lets the script speak for itself.

The README is short and backs itself with references: the vulnerability repository itself, the MITRE CVE entry for CVE-2022-22965, a blog post on the Spring RCE vulnerabilities, a Spring4Shell proof of concept, the Spring Framework RCE early announcement from spring.io, and a Rapid7 post on the Spring4Shell zero day. Together they give context on the vulnerability and how the detection payload relates to the public discussion around it. There is no installation or usage section in the README itself, just the detection method and the sources to read for context.

• Source 1 · Project repository
• Source 2 · README