Spring4Shell

securityprogramming

A 2022 remote code execution flaw in the Spring Framework for Java.

Spring4Shell let attackers achieve remote code execution through data binding in certain Spring configurations. Coming shortly after Log4Shell, it renewed attention on the risk carried by ubiquitous Java dependencies.

Spring4Shell was a remote code execution vulnerability in the Spring Framework, disclosed shortly after Log4Shell and inevitably compared to it. The comparison is instructive mostly for how different the two turned out to be.

Log4Shell was trivially exploitable in almost any deployment that logged user input, which is nearly all of them. Spring4Shell required a specific combination of Java version, deployment packaging and configuration, so the vulnerable population was a fraction of the framework's users. The initial reporting did not make that distinction, and a great many teams spent a weekend on an emergency that did not apply to them.

That gap between disclosure and applicability is the durable point. Severity scores describe the worst case, not your case, and the useful question during a disclosure is whether the preconditions hold in your environment rather than how high the number is. Teams that could answer that quickly, because they knew what they ran and how it was configured, spent an hour where others spent days. Inventory is what converts a headline into a decision.

Also known as: Spring4Shell, CVE-2022-22965

← All glossary entries