Proposal: Secure Coding Case Study for CVE-2022-22965 (Spring4Shell)

We want to add a case study for CVE-2022-22965 (Spring4Shell). Vulnerability: CVE-2022-22965 (Spring4Shell), Software: Spring Framework (5.3.0–5.3.17 and 5.2.0–5.2.19), Primary Weakness: CWE-94 (Improper Control of Generation of Code), Group Members: Anusha Gurram (@anusha2972), Bala Naga Tirumala Kiran Annadata (@kiranannadatha8), Group Number: 5.

Spring4Shell is an Remote Code Execution (RCE) in Spring's data binding mechanism. On JDK 9+, the module system re-exposed a path to the ClassLoader through property introspection that older JDKs had blocked. If you were running on Tomcat, an attacker could chain that access to mess with Tomcat's AccessLogValve, write a JSP web shell to disk, and get full code execution. CVSS 9.8, actively exploited.

References:

1. https://nvd.nist.gov/vuln/detail/CVE-2022-22965
2. https://www.cve.org/CVERecord?id=CVE-2022-22965
3. https://spring.io/security/cve-2022-22965

Start by reading the three cited CVE, NVD, and Spring security references, then review the repository's existing case-study format. Done means adding a case study for CVE-2022-22965 that accurately covers the listed vulnerability, affected Spring versions, CWE-94, impact, and references.