SECURITY ALERT: Spring Framework "Spring4Shell" RCE via Data Binding Vulnerability (CVE-2022-22965)

Product / Version includes:

Last updated: 2024/05/21

Solution ID: KA-0012910

Category: Update

Summary

April 6 @ 11PM US Central Time Update: DDI IPS rules have been updated

On March 30, 2022, information regarding a new 0-day critical vulnerability affecting the Spring Framework core - an extremely widely-used open-source application framework for the Java platform used in enterprise applications - was released on various websites and technical blogs. This vulnerability has been informally dubbed “Spring4Shell” by various outlets due to an initial perceived similarity to last year’s Log4Shell vulnerability in terms of potential exploit impact.

On March 31, 2022, Spring publicly acknowledged the issue through a disclosure with patch information, more specific affected criteria, and a formal CVE assignment of CVE-2022-22965 was issued by VMware (Spring’s parent).

Spring Framework 5.3.18 and 5.2.20, as well as Spring Boot 2.6.6 and 2.5.12 have been released officially that resolves the vulnerability.

Overview

Based on Spring’s official disclosure and Trend Micro Research’s own analysis, a vulnerability exists in the Spring MVC and WebFlux applications running on Java Development Kit (JDK) 9 and above where an attack could potentially exploit the applications by sending a specially crafted request to a vulnerable server. The vulnerability itself is due to an incomplete fix for an older vulnerability (CVE-2010-1622).

However, based on the current analysis the scenarios and requirements to be considered vulnerable are very specific and limited at this time:

Applications must be using JDK 9 or higher
Apache Tomcat as the Servlet container
Packaged as a traditional Web Application Resource (WAR) as opposed to a Spring Boot executable jar
Specific dependencies: spring-webmvc or spring-webflux
Use of Spring Framework below 5.3.18 (5.3x series) or 5.2.20 (5.2x series)

Please note: there is a lot of confusion between this issue and another recently disclosed vulnerability in Spring Cloud (CVE-2022-22963 ). Even though some outlets have also tried to coin the term “Spring4Shell” for this other vulnerability – they are completely unrelated.

Protection Against Exploitation

First and foremost, it is always highly recommended that users apply the vendor's patches when they become available.

Spring Framework 5.3.18 (5.3x) and 5.2.20 (5.2x) as well as Spring Boot 2.6.6 and 2.5.12 have been released to resolve the issue. Users are strongly encouraged to upgrade to these latest versions as soon as possible.

Spring has also posted some detailed workarounds in their blog that may be temporarily utilized until an upgrade is possible.

Trend Micro Protection and Investigation

In addition to the vendor patch(s) that should be applied, Trend Micro has released some supplementary rules, filters and detection protection that may help provide additional protection and detection of malicious components associated with this attack servers that have not already been compromised or against further attempted attacks.

Preventative Rules, Filters & Detection

Trend Micro Cloud One - Workload Security and Deep Security IPS Rules

Rule 1011372 - Spring Framework "Spring4Shell" Remote Code Execution Vulnerability (CVE-2022-22965)

Trend Micro Cloud One - Network Security and TippingPoint Filters

Filter 41108: HTTP: Spring Core Code Execution Vulnerability

Trend Micro Deep Discovery Inspector Network Content Inspection Rules

Rule 4678: CVE-2022-22965 - SPRING RCE EXPLOIT - HTTP(REQUEST)
Rule 4679: POSSIBLE JAVA CLASSLOADER RCE EXPLOIT - HTTP(REQUEST)

Trend Micro Cloud One - Open Source Security by Snyk

Trend Micro Cloud One - Open Source Security by Snyk can identify vulnerable versions across all organization source code repositories with very little integration effort. Once installed, it can also monitor progress on updating to non-vulnerable versions.

Impact on Trend Micro Products

As of this writing, no Trend Micro products have been found to be affected. Please refer to the KB article: SECURITY BULLETIN: Trend Micro Products and Spring Cloud (CVE-2022-22963) and Spring Framework (CVE-2022-22965) RCE Vulnerabilities for the complete list of products and the current status.

External References

Was this article helpful?

Featured

Automation Center

Education Portal

Online Help Center

Service Status

TrendConnect

SECURITY ALERT: Spring Framework "Spring4Shell" RCE via Data Binding Vulnerability (CVE-2022-22965)

Protection Against Exploitation

Trend Micro Protection and Investigation

Preventative Rules, Filters & Detection

Impact on Trend Micro Products

External References

SECURITY ALERT: Spring Framework "Spring4Shell" RCE via Data Binding Vulnerability (CVE-2022-22965)

Product / Version includes:

Summary

Overview

Protection Against Exploitation

Trend Micro Protection and Investigation

Preventative Rules, Filters & Detection

Impact on Trend Micro Products

External References