Spring4Shell: Class-Loader RCE to Webshell (CVE-2022-22965)

Multiple external addresses touched the Spring application. One of them sent a POST request whose parameters manipulated internal framework properties in a way no legitimate API client would. Identify the source address behind that exploitation request.

The class-loader exploit did not execute code directly; it abused the Tomcat logging system to write a file to disk. Identify the filename of the JSP that was written to the web application root.

The webshell runs commands on the operating system, but it does not choose who those commands run as. The OS account is whatever account the Tomcat process itself uses. Identify the service account that executed the shell commands.

The IP that planted the webshell and the IP that drove commands through it are distinct. Identify the address that acted as the hands-on operator after the webshell was established.

Shortly after gaining command execution, the attacker pivoted from the compromised application server to probe a backend service that is only reachable from inside the network. Identify the internal destination IP the compromised host connected to.

The attacker gained durable access to the compromised server not by adding a system service or a crontab entry but by planting a file inside the web application itself. Identify the MITRE ATT&CK technique that describes using a server-side web file for persistent access.