Spring is a popular enterprise grade application framework for Java, and Spring4Shell is the name given to a remote code execution vulnerability disclosed at the end of March.
There has been a lot of hype and confusion in the tech press surrounding this vulnerability, including confusing it with a CVE for Spring Cloud Function which was released at the same time, but the two are unrelated.
The Spring4Shell vulnerability (CVE-2022-22965) impacts SpringMVC and Spring WebFlux applications when running on Java JDK9 and later on a Tomcat application server. The vulnerability can be exploited to write to an arbitrary file on the server, which can then be leveraged to achieve a remote code execution.
The vulnerability is fixed by updating the Spring Framework to 5.3.18 and 5.2.20 or greater.
A Proof of Concept exploit for a web shell was made available on github for a short time, and even though it has now been removed, copies were clearly taken by malicious actors as Microsoft reports observing attacks against their cloud infrastructure based on the POC.
Full details of the vulnerability and its mitigations are provided in Spring’s Security Advisory
“We were very impressed with the service, I will say, the vulnerability found was one our previous organisation had not picked up, which does make you wonder if anything else was missed.”
Aim Ltd Chief Technology Officer (CTO)