An unauthenticated zero-day RCE vulnerability in the Spring Core Java framework called âSpring4Shellâ has been publicly disclosed.
Researchers disclosed a zero-day vulnerability, dubbed Spring4Shell, in the Spring Core Java framework called âSpring4Shell.â An unauthenticated, remote attacker could trigger the vulnerability to execute arbitrary code on the target system. The framework is currently maintained by Spring.io which is a subsidiary of VMware.
The Spring Framework is an application framework and inversion of control container for the Java platform. The frameworkâs core features can be used by any Java application, but there are extensions for building web applications on top of the Java EE (Enterprise Edition) platform.
The vulnerability was disclosed after a Chinese security researcher published a proof-of-concept (PoC) exploit before deleting its account (helloexp).
âThe exploit code targeted a zero-day vulnerability in the Spring Core module of the Spring Framework. Spring is maintained by Spring.io (a subsidiary of VMWare) and is used by many Java-based enterprise software frameworks.â reported the analysis published by Rapid7. âThe vulnerability in the leaked proof of concept, which appeared to allow unauthenticated attackers to execute code on target systems, was quickly deleted.â
The flaw has yet to be patched and impacts Spring Core on Java Development Kit (JDK) versions 9 and later. The vulnerability is a bypass for another vulnerability tracked asÂ
Rapid7 researchers pointed out that the vulnerability (and proof of concept) could be triggered only when a specific functionality is used. The exploit code released by the Chinese researchers is not related to a âcompletely differentâ unauthenticated RCE flaw that was published on March 29, 2022 for Spring Cloud.
âProof-of-concept exploits exist, but itâs currently unclear which real-world applications use the vulnerable functionality. Configuration and JRE version may also be significant factors in exploitability and the likelihood of widespread exploitation.â continues Rapid7.
The analysis of the flaw suggests that its impact may not be severe like other issues, like Log4J.
âExploitation requires an endpoint with DataBinder enabled (e.g. a POST request that decodes data from the request body automatically) and depends heavily on the servlet container for the application,â reads the analysis published by cybersecurity firm Praetorian.
Security researchers that tested the Spring4Shell exploit confirmed that it works. CERT/CC vulnerability analyst Will Dormann confirmed that the PoC exploit code works against the stock âHandling Form Submissionâ sample code fromÂ
Security experts are aware of public exploitation of the Spring4Shell in the attacks.