blog

The Spring4Shell confusion

As the guys at LunaSec have already mentioned (https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities/ ), there’s been a bit of confusion around “Spring4Shell” and similar vulnerabilities that have been reported almost at the same time.

On March 29th, 2022, two RCE vulnerabilities were being discussed on the internet. Most of the people talking about them believe they’re talking about “Spring4Shell” (CVE Added: CVE-2022-22965), but in reality they’re swapping notes about CVE-2022-22963.

LunaSec

We’d like to focus on this specific aspect in this post to keep things simple and clear.

  • Spring4Shell (CVE-2022-22965) is a Very Severe RCE vulnerability affecting Spring Core and its derivatives.
  • CVE-2022-22963 (no known name) is a less severe vulnerability that affects Spring Cloud Function.

To make matters a bit more confusing, there seems to have been reports of a third vulnerability affecting Spring’s deserialisation logic, but this turned out not to be exploitable.

So we have two vulnerabilities affecting related, but distinct, Spring libraries and both represent a serious weakness for any system using the affected versions under the required conditions.

The threat intel team at AppSec Phoenix has triggered the corresponding alerts in our platform so that anybody with applications potentially affected by the vulnerability gets the corresponding notifications.

Francesco is an internationally renowned public speaker, with multiple interviews in high-profile publications (eg. Forbes), and an author of numerous books and articles, who utilises his platform to evangelize the importance of Cloud security and cutting-edge technologies on a global scale.

Discuss this blog with our community on Slack

Join our AppSec Phoenix community on Slack to discuss this blog and other news with our professional security team

From our Blog

November brings a new release of the platform; as most of the features will be released in v3 we are providing a preview of what’s to come
aeappsecphoenix-com
What is the real cost of manual vulnerability management? in this snapshot we analyse the size of the problem and the requirement for a better and more automated approach
Francesco Cipollone
AppSec Phoenix, the leader in ASOC, pioneering the cloud security and application security relationship, was selected amongst thousands of startups and the only one in cybersecurity as a finalist for the prestigious world communication awards. AppSec Phoenix’s Francesco Cipollone, pioneering the cloud security and application security relationship, was selected as a finalist for the innovator of the year award.
Francesco Cipollone
Francesco Cipollone dreamed of creating an organizations that helps all security professionals love back the work on vulnerability management and application security. AppSec Phoenix’s Francesco Cipollone, pioneering the cloud security and application security relationship, was selected as a finalist for the innovator of the year award.
Francesco Cipollone

Join our Mailing list!

Get all the latest news, exclusive deals, and feature updates.

x Logo: Shield Security
This Site Is Protected By
Shield Security