Java Spring Framework RCE aka Spring4Shell (CVE-2022-22965)
Summary #
On 30 March 2022, details were leaked of a Spring Framework RCE that impacts Spring MVC and Spring WebFlux applications running on JDK 9+. The team at Spring released [a blog post](https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement) that documented the vulnerability. The exploit is commonly referenced as Spring4Shell.
Spring listed several conditions necessary to execute the exploit: - JDK 9 or higher - Spring Framework versions 5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and older versions - Tomcat must run on the application as a WAR deployment - Deployed as a standalone Tomcat instance - spring-webmvc or spring-webflux dependency
The conditions listed are only documented known vectors of exploitation and are not limited to that list.
WatchGuard has reviewed all its products and services and so far, has determined that several of the services meet one but not all of the Spring Framework vulnerability requirements. We have yet to confirm exploitation against our products because they do not meet the necessary conditions.
CVE identifiers #
| CVE ID | Description | CVSS |
|---|---|---|
| CVE-2022-22965 | A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it. | — |
Product status #
| Product | Affected | Not affected |
|---|
Solution #
No solution has been published for this advisory.