Detections
Analytics
Spring Framework < 5.2.20 / 5.3.x < 5.3.18 Remote Code Execution (Spring4Shell)
critical Web App Scanning Plugin ID 113217
Language:
Synopsis
Spring Framework < 5.2.20 / 5.3.x < 5.3.18 Remote Code Execution (Spring4Shell)Description
Spring MVC and Spring WebFlux applications, when packaged as a traditional WAR file, running on JDK version 9 and higher in an Apache Tomcat servlet container and exposing one or more endpoints with DataBinder enabled, suffer from a Remote Code Execution (RCE) vulnerability.By crafting a specific HTTP request, an attacker could leverage the vulnerability to compromise the target by, for example, hosting a web shell on the target application.
Solution
Depending on the current application version branch, update at least to Spring Framework 5.2.20 or 5.3.18. Due to its dependency to Spring Framework, Spring Boot should also be updated at least to versions 2.5.12 or 2.6.6. The Apache Tomcat team has released versions 10.0.20, 9.0.62, and 8.5.78 all of which close the attack vector on Tomcat's side.See Also
https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement
https://spring.io/blog/2022/04/01/spring-framework-rce-mitigation-alternative
Plugin Details
Severity: Critical
ID: 113217
Type: remote
Family: Component Vulnerability
Published: 3/31/2022
Updated: 10/21/2024
Scan Template: api, basic, full, pci, scan
Risk Information
VPR
Risk Factor: Critical
Score: 9.8
CVSS v2
Risk Factor: High
Base Score: 7.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2022-22965
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score Source: CVE-2022-22965
Vulnerability Information
CPE: cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 3/31/2022
Vulnerability Publication Date: 3/30/2022
CISA Known Exploited Vulnerability Due Dates: 4/25/2022
Reference Information
CVE: CVE-2022-22965
OWASP: 2010-A1, 2013-A1, 2013-A9, 2017-A1, 2017-A9, 2021-A3, 2021-A6
WASC: Improper Input Handling, OS Commanding
CAPEC: 10, 101, 108, 120, 13, 135, 14, 24, 242, 250, 267, 273, 28, 3, 34, 35, 42, 43, 45, 46, 47, 51, 52, 53, 6, 64, 67, 7, 71, 72, 76, 77, 78, 79, 8, 80, 83, 84, 9
DISA STIG: APSC-DV-002510, APSC-DV-002560, APSC-DV-002630
HIPAA: 164.306(a)(1), 164.306(a)(2)
ISO: 27001-A.14.2.5
NIST: sp800_53-CM-6b, sp800_53-SI-10
OWASP API: 2019-API7, 2019-API8, 2023-API8
OWASP ASVS: 4.0.2-14.2.1, 4.0.2-5.2.5