Quick update

• There are two vulnerabilities: one 0-day in Spring Core which is named Spring4Shell (very severe, exploited in the wild no CVE yet) and another one in Spring Cloud Function (less severe, CVE-2022-22963)
• Wallarm has rolled out the update to detect and mitigate both vulnerabilities
• No additional actions are required from the customers when using Wallarm in the blocking mode
• When working in a monitoring mode, consider creating virtual patches for the Spring Core vulnerability and for the Spring Cloud Function vulnerability

Log4Spring

Spring Framework is an extremely popular framework used by Java developers to build modern applications. If you rely on the Java stack it’s highly likely that your engineering teams use Spring. In some cases, it only takes one specially crafted request to exploit the vulnerability.

On March 29th, 2022, information about the POC 0-day exploit in the popular Java library Spring Core appeared on Twitter. Later it turned out that it’s two RCEs that are discussed and sometimes confused:

Later it turned out that it’s two RCEs that are discussed and sometimes confused:

• RCE in "Spring Core" (Severe, no patch at the moment) - Spring4Shell
• RCE in "Spring Cloud Function" (Less severe, see the CVE)

The vulnerability allows an unauthenticated attacker to execute arbitrary code on the target system. Within some configurations, it only requires a threat actor to send a specific HTTP request to a vulnerable system. Other configurations may require additional effort and research by the attacker

At the time of writing, Log4Spring is unpatched in the Spring Framework and there is a public proof-of-concept available. We see exploits in the wild.

Wallarm update

Wallarm automatically identifies attempts of the Spring4shell exploitation and logs these attempts in Wallarm Console.

Mitigation

When using Wallarm in blocking mode, these attacks will be automatically blocked. No actions are required.

When using a monitoring mode, we suggest creating virtual patches for the Spring Core vulnerability and for the Spring Cloud Function vulnerability.

You can search for the relevant events in Wallarm Console by using Spring4Shell filter.

Feel free to reach out to support@wallarm.com if you need assistance.