Spring4Shell (CVE-2022-22965)

Spring4Shell is the common name for CVE-2022-22965, a remote-code-execution vulnerability in Spring Framework data binding. Spring published an advisory on March 31, 2022.

Affected deployments

According to the Spring advisory, the documented exploit path required JDK 9 or later, Apache Tomcat as the servlet container, a traditional WAR deployment, and Spring Web MVC or WebFlux. Default Spring Boot executable-jar deployments were not vulnerable to that path.

The affected Spring Framework ranges included 5.3.0 through 5.3.17 and 5.2.19.RELEASE and earlier. Spring released fixes in 5.3.18 and 5.2.20.RELEASE.

Response

Guidance emphasized updating Spring Framework as the primary remediation, with Tomcat upgrades and other mitigations available for particular environments. The event was widely nicknamed Spring4Shell, although the CVE and vendor advisory define the scope more precisely.

Timeline

• 2022-03-31Spring publishes its advisory for CVE-2022-22965.
• 2022-03-31Spring Framework 5.3.18 and 5.2.20.RELEASE are identified as fixed versions.
• 2022-04-01Spring publishes additional mitigation guidance.