Unpatched Java Spring Framework 0-Day RCE Bug Threatens Enterprise Web Apps Security
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2010-1622 | NVD description · AI analysis pending | — | 52% | — | — | — | |
| CVE-2022-22950 | n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cau n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition. NVD description · AI analysis pending | 6.5 | 36% |
| — | ||
| CVE-2022-22963 | SpEL Expression Injection RCE in VMware Tanzu Spring Cloud Function VMware Tanzu's Spring Cloud Function contains a remote code execution flaw (CWE-94, expression-language code injection) in its routing functionality. When the routing feature evaluates an attacker-supplied Spring Expression Language (SpEL) routing-expression, a specially crafted expression is processed by the framework, resulting in arbitrary code execution on the server and access to local resources. Any deployment of Spring Cloud Function that evaluates untrusted routing-expressions, typically via exposed application endpoints, is affected. An attacker who can reach such an endpoint gains code execution in the context of the running application, which can lead to data theft, lateral movement, or ransomware. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2022-08-25 and EPSS rates the 30-day exploitation probability at 99.9% (100th percentile), although no public PoC is cataloged in this data. Do: Apply the vendor update per VMware/Tanzu instructions immediately, as patching is the required action for this KEV-listed vulnerability. Until patched, prevent untrusted clients from supplying the routing-expression (restrict or disable the routing functionality) and limit network exposure of affected services. Review application logs for unexpected SpEL payloads in routing-expressions and check affected hosts for indicators of compromise, including ransomware staging. | 9.8 | 100% | KEV PoC |
| largeplausibly tens of thousands of deployments (10,000-100,000 systems); exact installed base unpublished |
Full article482 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMar 31, 2022
A zero-day remote code execution (RCE) vulnerability has come to light in the Spring framework shortly after a Chinese security researcher briefly leaked a proof-of-concept (PoC) exploit on GitHub before deleting their account.
According to cybersecurity firm Praetorian, the unpatched flaw impacts Spring Core on Java Development Kit (JDK) versions 9 and later and is a bypass for another vulnerability tracked as CVE-2010-1622, enabling an unauthenticated attacker to execute arbitrary code on the target system.
Spring is a software framework for building Java applications, including web apps on top of the Java EE (Enterprise Edition) platform.
"In certain configurations, exploitation of this issue is straightforward, as it only requires an attacker to send a crafted HTTP request to a vulnerable system," researchers Anthony Weems and Dallas Kaman said. "However, exploitation of different configurations will require the attacker to do additional research to find payloads that will be effective."
Additional details of the flaw, dubbed "SpringShell" and "Spring4Shell," have been withheld to prevent exploitation attempts and until a fix is in place by the framework's maintainers, Spring.io, a subsidiary of VMware. It's also yet to be assigned a Common Vulnerabilities and Exposures (CVE) identifier.
It's worth noting that the flaw targeted by the zero-day exploit is different from two previous vulnerabilities disclosed in the application framework this week, including the Spring Framework expression DoS vulnerability (CVE-2022-22950) and the Spring Cloud expression resource access vulnerability (CVE-2022-22963).
In the interim, Praetorian researchers are recommending "creating a ControllerAdvice component (which is a Spring component shared across Controllers) and adding dangerous patterns to the denylist."
Initial analysis of the new code execution flaw in Spring Core suggests that its impact may not be severe. "[C]urrent information suggests in order to exploit the vulnerability, attackers will have to locate and identify web app instances that actually use the DeserializationUtils, something already known by developers to be dangerous," Flashpoint said in an independent analysis.
Despite the public availability of PoC exploits, "it's currently unclear which real-world applications use the vulnerable functionality," Rapid7 explained. "Configuration and JRE version may also be significant factors in exploitability and the likelihood of widespread exploitation."
The Retail and Hospitality Information Sharing and Analysis Center (ISAC) also issued a statement that it has investigated and confirmed the "validity" of the PoC for the RCE flaw, adding it's "continuing tests to confirm the validity of the PoC."
"The Spring4Shell exploit in the wild appears to work against the stock 'Handling Form Submission' sample code from spring.io," CERT/CC vulnerability analyst Will Dormann said in a tweet. "If the sample code is vulnerable, then I suspect there are indeed real-world apps out there that are vulnerable to RCE."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2022/03/unpatched-java-spring-framework-0-day.html