Spring4Shell: check your setup, then patch
The new Spring Framework bug is serious but narrower than Log4Shell. Here’s how to know if you’re affected.
Last week a remote code execution bug in Spring Framework (CVE-2022-22965) leaked before a fix was ready, and the internet named it Spring4Shell. Coming four months after Log4Shell, people panicked. It’s serious, but it’s narrower.
The known attack needs all of these:
- JDK 9 or newer,
- Spring MVC or Spring WebFlux,
- Apache Tomcat as the servlet container,
- the app packaged as a traditional WAR file.
Spring Boot apps running as an executable JAR aren’t affected by the known exploit, though there may be other ways in.
What to do:
- Upgrade to Spring Framework 5.3.18 or 5.2.20, or Spring Boot 2.6.6 / 2.5.12, which include the fix.
- If you can’t yet, upgrading Tomcat to its patched versions also blocks the known attack.
- Don’t confuse it with a separate Spring Cloud Function bug released the same week. Patch that too if you use it.
After Log4Shell, many teams knew where their Java apps lived. If you didn’t, this is the week to start that list.