Background /What has happened?

In March 2022, reports emerged relating to multiple vulnerabilities in relation to the Spring Framework and its operating environments. A malicious cyber actor may be able to exploit these vulnerabilities to execute arbitrary code, including malware or ransomware. VMWare has released a security advisory which addresses CVE-2022-22963 in Spring Cloud Function and the CVE-2022-22965 in Spring WebFlux Application. The Spring4Shell vulnerability has been likened to the Apache Log4J vulnerabilities discovered in late 2021. Similarly to Apache Log4j, the Spring Framework is a ubiquitous building block used in potentially hundreds of thousands of applications across the internet, and the vulnerability allows malicious cyber actors to execute arbitrary code on target machines.

Australian organisations should be aware of these risks and apply necessary patches. If you are a developer of any affected software, the ACSC advises early communication with your customers to enable them to apply mitigations and install updates where they are available.

Mitigation / How do I stay secure?

To address CVE-2022-22963 Australian organisations should consult and action the recommendations contained within the vendor’s security advisories, CVE-2022-22963, and CVE-2022-22965. Australian organisations should review systems for the presence of Spring Core and patch where available, prioritising external facing systems. If Spring Core is present consider reviewing web application logs for indications of unusual requests which could indicate exploitation attempts. Australian organisations should also consider reviewing for the recent creation of .jsp files.

The ACSC recommends that users of the Spring Framework should monitor for the release of updated software versions and security advisories. ACSC will continue to monitor this issue and update as necessary.