https://souljian.cn/tags/tomcat/Recent content in Tomcat on SoulJian小站Hugo -- gohugo.ioen-usSun, 30 Aug 2026 10:00:00 +0800https://souljian.cn/p/751088170/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088170/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>Spring4Shell 攻击只在授权测试环境进行。对非授权目标进行攻击可能触犯法律。</p> <h2 id="一spring4shell-利用链">一、Spring4Shell 利用链 </h2><img src="https://souljian.cn/img/spring4shell-chain.svg" alt="Spring4Shell 攻击链" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">① 发现 Spring Boot → ② 确认版本/JDK/Tomcat → ③ ${...} 注入 → ④ 写 TLD 文件 → ⑤ 触发加载 → ⑥ RCE </span></span></code></pre></td></tr></table> </div> </div><h2 id="二漏洞信息">二、漏洞信息 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">CVE-2022-22965 </span></span><span class="line"><span class="cl">影响：Spring Framework 5.3.0~5.3.17 / 5.2.0~5.2.19 </span></span><span class="line"><span class="cl">条件：Tomcat + JDK 9-17 </span></span><span class="line"><span class="cl">入口：Content-Type / Accept 头中 ${...} </span></span></code></pre></td></tr></table> </div> </div><h2 id="三利用步骤">三、利用步骤 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">确认版本（Spring Boot / Tomcat / JDK） </span></span><span class="line"><span class="cl">→ 构造 ${jndi:ldap://xxx} payload </span></span><span class="line"><span class="cl">→ 注入到 Content-Type 头 </span></span><span class="line"><span class="cl">→ 反弹 Shell </span></span></code></pre></td></tr></table> </div> </div><h2 id="四防御加固">四、防御加固 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">升级到 Spring Framework 5.3.18+ </span></span><span class="line"><span class="cl">或打官方补丁 </span></span><span class="line"><span class="cl">WAF 拦截 ${ 表达式 </span></span></code></pre></td></tr></table> </div> </div><h2 id="五小结">五、小结 </h2><p>Spring4Shell 是 Spring Framework 的远程代码执行漏洞。<strong>升级补丁</strong>是唯一有效的防御手段。</p>