Hacker

Patch finally released for Spring4Shell zero-day

With proof-of-concept code out in the wild, businesses are encouraged to assess their exposure to what's being dubbed 'Log4Shell 2.0'
Pro
Image: Gerd Altmann (cc)

1 April 2022

Spring has released an update to its core framework that is thought to bring with it a security fix for the Spring4Shell zero-day discovered this week.

The maintainer of the widely used open source Java framework announced the fix was available on Thursday afternoon after businesses scrambled to assess their exposure to the newly discovered zero-day, for which there were already publicly available proof-of-concept (PoC) exploits.

The latest version, dubbed 5.3.18, can be downloaded now and early reports from experts suggest the security fix is working. Businesses are recommended to upgrade to the latest version to avoid falling victim to the remote code execution (RCE) flaw.

“[I] quickly tested Spring Framework’s 5.3.18 release and it does stop the original PoC,” said security researcher Jacob Baines. “Obviously, need to spend some time looking at their changes, but a good start.”

A backported fix for Spring4Shell is also included in Spring’s 5.2.20 version update which is also available now. The community is still waiting for a CVE tracking code.

What is Spring4Shell?

Businesses were left exposed this week to a zero-day security vulnerability branded ‘Spring4Shell’ while PoC exploits proliferated in the public domain.

Spring4Shell is a zero-day vulnerability found in the popular Spring Core Framework for Java applications, that could be exploited for remote code execution (RCE) attacks on affected machines.

The open source Spring Core Framework is one of the most popular Java Enterprise Edition frameworks and offers features to create high-performance Java applications. All Spring Core Framework versions running JDK 9 and newer are thought to be vulnerable.

The flaw has been compared to the Log4Shell vulnerability affecting the log4j2 Java logging utility, but the two are unrelated. Spring4Shell can also only be exploited if a number of prerequisites are met, according to security researcher Will Dormann, unlike Log4Shell which affected all versions of log4j2.

All vulnerable versions of the Spring Core Framework also use Spring Beans, he said – a complex component of the framework that involves a project’s supporting objects, Spring Parameter Binding, and Spring Parameter Binding must also be configured using a non-basic parameter type such as POJOs.

Cyber security company Tenable said it’s unclear how common these prerequisites are in real-world applications, but they are necessary for exploitation and there is evidence of PoCs already.

“In certain configurations, exploitation of this issue is straightforward, as it only requires an attacker to send a crafted HTTP request to a vulnerable system,” said Praetorian, one of the first security companies to confirm the vulnerability, in a blog post. “However, exploitation of different configurations will require the attacker to do additional research to find payloads that will be effective.

“This vulnerability allows an unauthenticated attacker to execute arbitrary code on the target system.”

Praetorian also said the vulnerability is effective since it bypasses a previous patch made nearly 12 years ago for CVE-2010-1622, a separate code injection vulnerability in the Spring Core Framework.

Some members of the security community have been confusing two separate Spring vulnerabilities. This week’s Spring4Shell and CVE-2022-22963 are entirely separate, the latter being a flaw in the Spring Cloud Function, which was patched on 29 March, one day before Sring4Shell was identified, Tenable said.

Future Publishing

Read More:


Back to Top ↑

TechCentral.ie