Back to CVEs & Disclosures
CRITICAL — CVSS 9.8

Spring Framework Data Binding Remote Code Execution (Spring4Shell)

Class loader manipulation vulnerability in Spring Framework data binding on Java 9+ allowing attackers to overwrite Tomcat logging configurations and drop web shells.

Status
Vendor Patched
Reported / Disclosed
2022

Impact

  • Traversal through AccessLogValve parameters via module.class.classLoader binding.
  • Creation of arbitrary JSP web shell files inside web root directory.
  • Full system takeover on Tomcat-deployed Java web applications.

Timeline

  1. MARCH 30, 2022

    Spring Framework security team triaged emergency patch release.

  2. MARCH 31, 2022

    Spring Framework 5.3.18 and 5.2.20 released addressing classloader introspection.

aura~
Back to CVEs & Disclosures