Test ID:	1.3.6.1.4.1.25623.1.0.113882
Category:	Web application abuses
Title:	VMware Spring Boot RCE Vulnerability (Spring4Shell, SpringShell)
Summary:	VMware Spring Boot is prone to a remote code execution (RCE); vulnerability in the used Spring Framework dubbed 'Spring4Shell' or 'SpringShell'.
Description:	Summary: VMware Spring Boot is prone to a remote code execution (RCE) vulnerability in the used Spring Framework dubbed 'Spring4Shell' or 'SpringShell'. Vulnerability Insight: A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it. Affected Software/OS: VMware Spring Boot versions prior to 2.5.12 and 2.6.x prior to 2.6.6. The following are the requirements for an environment to be affected to this specific vulnerability: - Running on JDK 9 or higher - Apache Tomcat as the Servlet container - Packaged as a traditional WAR and deployed in a standalone Tomcat instance. Typical Spring Boot deployments using an embedded Servlet container or reactive web server are not impacted. - spring-webmvc or spring-webflux dependency - an affected version of Spring Boot Solution: Update to Spring Boot version 2.5.12, 2.6.6 or later which updates to Spring Framework version 5.3.18 or later. Possible mitigations without doing an update: - Upgrading Tomcat (10.0.20, 9.0.62 or 8.5.78 hardened the class loader to provide a mitigation) - Downgrading to Java 8 - Disallowed Fields Please see the references for more information on these mitigation possibilities. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2022-22965 Cisco Security Advisory: 20220401 Vulnerability in Spring Framework Affecting Cisco Products: March 2022 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67 https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005 http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html https://tanzu.vmware.com/security/cve-2022-22965 https://www.oracle.com/security-alerts/cpuapr2022.html https://www.oracle.com/security-alerts/cpujul2022.html
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.