Spring4Shell (CVE-2022-22965) ClassLoader Block Rule for Nginx

Neutralize Spring Framework remote code execution exploits targeting Tomcat access logs with Nginx parameter inspection rules.

1. Attack Signature & Impact Analysis

Critical (CVSS 9.8 RCE)

Exploits data binding in Spring MVC by binding parameters to `class.module.classLoader` to rewrite Tomcat valve logging patterns into executable `.jsp` webshells.

2. Production Hardening Configuration (`/etc/nginx/conf.d/block-spring4shell.conf`)

Deploy this validated configuration to your production server or reverse proxy:

# Block requests containing ClassLoader manipulation patterns
server {
    if ($query_string ~* "class\.(module|classLoader)") {
        return 403;
    }
    
    # Block in POST request arguments
    if ($request_body ~* "class\.(module|classLoader)") {
        return 403;
    }
}

3. Live Simulation & Rule Verification Command

Execute these commands to verify that traffic is actively mitigated without service downtime:

# Test with benign probe query
curl -I "https://yourdomain.com/index?class.module.classLoader.URLs=test"
# Must return HTTP 403 Forbidden

4. Common Misconfigurations & Troubleshooting Gotchas

⚠️ Production Caution: Inspection of $request_body in Nginx requires body buffering enabled (`client_body_buffer_size`). For multi-part uploads, a dedicated WAF is recommended.

5. Best Paired With (Complementary Defense Recipes)

Security engineers implementing this rule frequently deploy these complementary baselines: