Protect Applications from Spring4Shell. (CVE-2022-22965)

Of the three new Spring framework vulnerabilities, one of them (Spring4Shell) sounds worryingly similar to the recent high-severity exploit, Log4Shell. While the vulnerabilities discovered in the Spring framework do have some things in common with Log4Shell, there are also significant differences impacting how we should respond. Of the three Spring vulnerabilities, two are critical, allowing for remote code execution (RCE), while the third is a denial-of-service vulnerability.

Protect Your Web Applications from Spring4Shell

F5 Labs recently shared an article their insights on these Spring Framework vulnerabilities; exploring the weaknesses, how they are exploited, and some general steps to mitigate your risk.

Spring Framework RCE (Spring4Shell): CVE-2022-22965
Spring Framework DoS: CVE-2022-22950
Spring Cloud RCE: CVE-2022-22963

To read the whole article and learn about active attacks exploiting these weaknesses head over to the F5 Labs article What Are the Spring4Shell Vulnerabilities? and then come back here to discuss how to implement security controls that mitigate your risk.