Trend Micro Threat Research observed active exploitation of CVE-2022-22965 (Spring4Shell) enabling threat actors to weaponize and execute the Mirai botnet. The exploit chain drops Mirai in /tmp, changes permissions, and deploys a JSP web shell to execute commands on vulnerable Tomcat servers. Hashtags: #Mirai #Spring4Shell #CVE-2022-22965 #Tomcat #AccessLogValve #Java9 #TrendMicro #VisionOne
Keypoints
- Active exploitation of CVE-2022-22965 (Spring4Shell) enables weaponization and execution of Mirai malware.
- The Mirai sample is downloaded to the /tmp folder and executed after permission changes (chmod).
- Exploitation involves manipulating Java class loader properties to expose and abuse object chains in Spring Core.
- A JSP web shell is created (tomcatwar.jsp) in the web root to provide remote command execution.
- Stage 1–3 workflow includes crafted requests, web shell deployment, and remote command execution (e.g., whoami).
- Trend Micro provides patches and mitigations (update Spring and Spring Boot; WAF/disable risky patterns) and detects with IPS/filters across products.
MITRE Techniques
- [T1190] Exploitation of Public-Facing Application – Trend Micro notes active exploitation of the Spring4Shell vulnerability CVE-2022-22965 that enables Mirai weaponization and execution. [‘Trend Micro Threat Research observed active exploitation of the Spring4Shell vulnerability assigned as CVE-2022-22965, which allows malicious actors to weaponize and execute the Mirai botnet malware.’]
- [T1105] Ingress Tool Transfer – The Mirai sample is downloaded to the “/tmp” folder and executed after permission changes. [‘The exploitation allows threat actors to download the Mirai sample to the “/tmp” folder and execute them after permission change using “chmod”.’]
- [T1059.004] Unix Shell – Stage 2/3 payloads execute system commands via Java Runtime. [‘java.io.InputStream in = %{c1}i.getRuntime().exec(request.getParameter(“cmd”)).getInputStream();’]
- [T1505.003] Web Shell – Stage 2 creates a JSP web shell (tomcatwar.jsp) in the webapps/ROOT directory for remote command execution. [‘When a server handles this request, it creates a “tomcatwar.jsp” file on the server directory…’]
Indicators of Compromise
- [IP Address] – 45.95.169.143, 10.10.10.176 – used in malicious system downloads and detection examples (e.g., Mirai binaries hosting and Vision One Workbench triggers).
- [URL] – http://{victim IP}:9090/tomcatwar.jsp?pwd=j&cmd=… – example of remote command execution via the JSP web shell.
- [File] – tomcatwar.jsp – JSP web shell created on vulnerable servers; used to execute commands remotely.
- [Domain] – The420smokeplace.dns – domain used to host Mirai binaries for download.
- [File] – wget.sh – script that downloads binaries and executes Mirai samples before cleanup.