Mitigating Spring4Shell with Group-IB

The report details Spring4Shell (CVE-2022-22965), a critical (CVSS 9.8), easy-to-exploit remote code execution vulnerability in certain Spring Framework installations (notably when deployed as a WAR on Tomcat with Java 9+ and using spring-webmvc or spring-webflux). Exploitation can result in arbitrary file writes (webshells) and full application compromise; recommended actions include upgrading to Spring 5.3.18 or 5.2.20, monitoring public web directories for new files, applying WAF signatures, and enhancing logging and detection. Group-IB reports dark-web discussion of the flaw but had not observed active attacks at the time of writing and states its own products are not affected.