Patch finally released for Spring4Shell zero-day after vulnerable businesses put on high alert

Spring has released an update to its core framework that is thought to bring with it a security fix for the Spring4Shell zero-day discovered this week.

The maintainer of the widely used open source Java framework announced the fix was available on Thursday afternoon after businesses scrambled to assess their exposure to the newly discovered zero-day, for which there were already publicly available proof-of-concept (PoC) exploits.

The latest version, dubbed 5.3.18, can be downloaded now and early reports from experts suggest the security fix is working. Businesses are recommended to upgrade to the latest version to avoid falling victim to the remote code execution (RCE) flaw.

"[I] quickly tested Spring Framework's 5.3.18 release and it does stop the original PoC," said security researcher Jacob Baines. "Obviously, need to spend some time looking at their changes, but a good start."

A backported fix for Spring4Shell is also included in Spring's 5.2.20 version update which is also available now. The community is still waiting for a CVE tracking code.

What is Spring4Shell?

Businesses were left exposed this week to a zero-day security vulnerability branded ‘Spring4Shell’ while PoC exploits proliferated in the public domain.

Spring4Shell is a zero-day vulnerability found in the popular Spring Core Framework for Java applications, that could be exploited for remote code execution (RCE) attacks on affected machines.

The open source Spring Core Framework is one of the most popular Java Enterprise Edition frameworks and offers features to create high-performance Java applications. All Spring Core Framework versions running JDK 9 and newer are thought to be vulnerable.

The flaw has been compared to the Log4Shell vulnerability affecting the log4j2 Java logging utility, but the two are unrelated. Spring4Shell can also only be exploited if a number of prerequisites are met, according to security researcher Will Dormann, unlike Log4Shell which affected all versions of log4j2.

All vulnerable versions of the Spring Core Framework also use Spring Beans, he said - a complex component of the framework that involves a project’s supporting objects, Spring Parameter Binding, and Spring Parameter Binding must also be configured using a non-basic parameter type such as POJOs.

Cyber security company Tenable said it’s unclear how common these prerequisites are in real-world applications, but they are necessary for exploitation and there is evidence of PoCs already.

“In certain configurations, exploitation of this issue is straightforward, as it only requires an attacker to send a crafted HTTP request to a vulnerable system,” said Praetorian, one of the first security companies to confirm the vulnerability, in a blog post. “However, exploitation of different configurations will require the attacker to do additional research to find payloads that will be effective.

“This vulnerability allows an unauthenticated attacker to execute arbitrary code on the target system.”

Praetorian also said the vulnerability is effective since it bypasses a previous patch made nearly 12 years ago for CVE-2010-1622, a separate code injection vulnerability in the Spring Core Framework.

Some members of the security community have been confusing two separate Spring vulnerabilities. This week's Spring4Shell and CVE-2022-22963 are entirely separate, the latter being a flaw in the Spring Cloud Function, which was patched on 29 March, one day before Sring4Shell was identified, Tenable said.

“With some early reports surfacing that Spring4Shell is significantly different from log4j, we’ll know more as an industry soon enough on its severity and risk level,” said Sam Curry, CSO at Cybereason to IT Pro.

“More embedded system weaknesses are lurking out there. Sadly, we live in an age where adversaries have the skills to quickly exploit these vulnerabilities. Now the call is out for defenders to adapt, innovate faster and thrive. Spring4Shell is another wake up call, but there will be more vulnerabilities coming next month and beyond.”