Dynatrace : What is Spring4Shell? Detect and mitigate new zero-day vulnerabilities in the Java Spring Framework

This article was co-authored with Robin Wyss.

CVE recently published three new critical vulnerabilities in the Java Spring Framework, including one called Spring4Shell.

Many applications are potentially affected, as Spring dominates the Java ecosystem, with 60% of developers using it in their main Java applications.

In what follows, we provide clarity on recently published vulnerabilities in the Spring Framework and a short how-to guide to help you identify if your organization is affected.

What is Spring4Shell?

Spring4Shell is a critical vulnerability in the Java Spring framework and one out of three published on March 30:

1. Spring Core RCE (critical): CVE-2022-22965 a.k.a. Spring4Shell
   Affected library: org.springframework:spring-bean
2. Information Exposure in Spring Cloud Function: CVE-2022-22963
   Affected library: org.springframework.cloud:spring-cloud-function-context
3. Denial of Service in Spring Expressions: CVE-2022-22950
   Affected library: org.springframework:spring-expression

Spring4Shell is severe as it can be exploited for remote code execution. There are already proof-of-concept exploits available publicly. Spring has already published a fix in Spring Framework 5.3.18 or 5.2.20.

There are several methods and tooling available to identify if an application is affected. We explore two options below:

• Using Dynatrace Application Security
• Using the Apache Maven Dependency plugin

Dynatrace Application Security detects the affected components automatically

For customers using Dynatrace Application Security, Dynatrace detects all three vulnerabilities automatically and in all locations across highly distributed hybrid, multicloud environments.

If you have security notifications set up, Dynatrace automatically sends a notification with the relevant details for each vulnerability upon discovery.

You can also find the vulnerabilities in Dynatrace in two additional ways:

1. Sorting the vulnerability list by first seen
2. Finding the vulnerabilities using the CVE or SNYK ID:
   • Spring Core RCE: search for CVE-2022-22965 or SNYK-JAVA-ORGSPRINGFRAMEWORK-2436751
   • Information Exposure in Spring Cloud Function: search for CVE-2022-22963 or SNYK-JAVA-ORGSPRINGFRAMEWORKCLOUD-2436645
   • Denial of Service in Spring Expressions: search for CVE-2022-22950 or SNYK-JAVA-ORGSPRINGFRAMEWORK-2434828

Dynatrace detects the Spring4Shell vulnerability in the Java Spring Framework

In this example, we can see how Dynatrace discovered CVE-2022-22965 and CVE-2022-22963.

Use the Apache Maven Dependency plugin to detect affected components manually

Another option is to use the Apache Maven Dependency plugin to identify whether your projects use affected libraries. Navigate to the directory of your maven project and run the following three commands to find out if your application is impacted:

Spring Core RCE

mvn dependency:tree -Dincludes=org.springframework:spring-beans

Maven finds vulnerable spring-beans version 5.3.13

Here we can see that the application uses spring-beans version 5.3.13 and is therefore affected.

Information Exposure in Spring Cloud Function

mvn dependency:tree -Dincludes=org.springframework.cloud:spring-cloud-function-context

Maven finds information exposure in Spring Cloud Function

Here we can see that the application uses spring-cloud-function-context version 3.2.2 and is therefore affected.

Denial of Service in Spring Expressions

mvn dependency:tree -Dincludes=org.springframework:spring-expression

Maven finds denial of service in Spring Expressions

Here we can see that the application uses spring-expression version 5.3.16 and is therefore affected.

How to mitigate risk

Here is how to mitigate risk for the Spring4Shell vulnerabilities.

1. Spring Core RCE is resolved in versions 5.2.20 and 5.3.18 or higher.
2. Information Exposure in Spring Cloud Function is resolved in versions 3.1.7 and 3.2.3 or higher.
3. Denial of Service in Spring Expressions is resolved in version 5.3.17 or higher.

See the blog post Spring Framework RCE, Early Announcement for further details.

How to get Dynatrace Application Security

If you are a Dynatrace customer and want to start using the Application Security module for automatic runtime vulnerability analysis, go to the Dynatrace web UI and select Vulnerabilities in the menu.

If you're not using Dynatrace yet, it's easy to get started in under five minutes with the Dynatrace free trial and contact us for how you can enable Dyantrace Application Security.