Alert - Spring remote code execution vulnerabilities

Number: AL22-004
Date: 31 March 2022

Audience

This Alert is intended for IT professionals and managers of notified organizations.

Purpose

An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.

Overview

On 30 March 2022, security researchers disclosed proof-of-concept exploitation code online for a vulnerability in the Java Spring Framework on Java Development Kit (JDK) versions 9 and up. The existence of the vulnerability and potential for exploitation has since been independently confirmed Footnote 1 Footnote 2Footnote 3.

Spring subsequently published a blog article to address the vulnerability, and has released patches, workarounds and methods to identify the vulnerability Footnote 4.

Spring published updates Footnote 5 to address vulnerabilities in Spring Cloud Function on 29 March, but it should be noted that these vulnerabilities are distinct from those in the Spring Core Framework.

Details

On 31 March 2022, developers of the Spring Core framework reported a critical remote code execution (RCE) vulnerability that “impacts Spring MVC and Spring WebFlux applications running on the Java Development Kit (JDK) 9+” Footnote 4. This vulnerability is known in the open-source security community as Spring4Shell or SpringShell. Spring states that “the specific exploit requires the application to be packaged as a Web application ARchive (WAR) and deployed to Apache Tomcat” Footnote 1. However, as it is possible that new methods for exploiting this vulnerability will emerge, patching affected applications is highly recommended.

At the time of reporting, applications are only vulnerable under certain conditions, and not all deployments will be affected by this vulnerability Footnote 4.

Security researchers state that in order to be vulnerable, a Spring application must “make use of Spring Beans, use Spring Parameter Binding, and a Spring Parameter Binding must be configured to use a non-basic parameter type, such as POJOs (Plain Old Java Objects)” Footnote 1. It is strongly recommended to continue to monitor the Spring blog on this topic for updates as the situation is evolving Footnote 4.

In open-source discourse on this topic, the vulnerability described in this Alert was often confused with a recently patched vulnerability in Spring Cloud (CVE-2022-22963) Footnote 5. It should be noted that these two vulnerabilities are not related, but both should be patched or mitigated in a timely manner.

Proof-of-concept code for CVE-2022-22963 and SpringShell exists publicly, and sources have reported successful exploitation under certain circumstances Footnote 1Footnote 2Footnote 3.

Suggested action

For organizations who have deployed these products, the Cyber Centre recommends the following mitigations to protect applications and systems affected by these vulnerabilities:

  • Continue to monitor the Spring blog posts on this issue, as the situation is still developing Footnote 4Footnote 5
  • Patch affected applications with Spring Framework 5.3.18 or 5.2.20 and Spring Cloud 3.17, 3.2.3, which address SpringShell and CVE-2022-22963, respectively
  • If patching is not immediately possible, follow all suggested vendor workarounds Footnote 4Footnote 5
  • Use a Web Application Firewall (WAF) wherever possible
  • Consider implementing workarounds and YARA rules shared by security researchers Footnote 1Footnote 2Footnote 3Footnote 6 if patching is not possible
Report a problem on this page
Please select all that apply:

Thank you for your help!

You will not receive a reply. For enquiries, please contact us.

Date modified: