Spring4Shell - the next interpreter/RCE tsunami

[Lob]

Another month, another big CVE: https://www.tenable.com/blog/spring4shell-faq-spring-framework-remote-code-execution-vulnerability

Like the original Batman movie, you need several things (the Joker has toothpaste and shampoo as the poison combination I think....):

• Java Development Kit (JDK) 9 or greater
• Apache Tomcat as the Servlet container
• Packaged as a WAR
• spring-webmvc or spring-webflux dependency

I don't believe these to be the last Java libraries to have such flaws and am wondering how we begin to inventorise and assess these - because that's what the bad guys will be doing.

What do others think? Are we at the beginning of a trend?

 

[PHolder]

It needs to be determined, but I don't think this will be as bad as the Log4J issue because I think one knows if one is running the Spring framework, and many business users have been conservative (i.e. slow to update) and so may be on older versions that are not affected. Never the less, there will likely still be confusion around "are we affected" and some heated activity around testing for vulnerability and the subsequent planning of updates.

EDIT: Just saw this: https://arstechnica.com/information...ll-the-internet-security-disaster-that-wasnt/

EDIT 2: There's also this https://isc.sans.edu/forums/diary/S...ate+Exploitation+Attempts+CVE202222965/28504/

 

[Barry Wallis]

Never the less, there will likely still be confusion around "are we affected" and some heated activity around testing for vulnerability and the subsequent planning of updates.

Not a bad thing.