There’s a significant number of prerequisites for #Spring4Shell
We don’t know how many applications are vulnerable but it’s far less serious than initially expected
242130
Beiträge mit #Spring4Shell
#Spring4Shell
Öffentliche Beiträge auf X, die #Spring4Shell verwenden.
Verwandte Hashtags
Checkmarx is closely monitoring #Spring4Shell and all other Spring vulnerabilities (CVE-2022-22963, CVE-2022-22950). Checkmarx SCA customers can scan their code for those vulnerabilities and get the latest remediation solutions. #springshell156
LunaSec (@[email protected])@LunaSecIOWe've published an analysis of the #Spring4Shell RCE to help provide better "facts" about what we know so far. There are 2 vulnerabilities and people are confusing them. Note: This post is Markdown on GitHub if you'd like to add anything (link in thread).3127262
Pentester Academy@SecurityTube🧵 New Blog: Spring4Shell Vulnerability Explained Learn how a Java 9 architectural change led to a critical RCE vulnerability affecting millions of Spring applications. Must-read for #Java devs & #AppSec teams #Spring4Shell #InfoSec0371.1K
FullHunt@FullHuntFullHunt developed spring4shell, an open-source tool for discovering spring4shell and Spring Cloud RCE at scale. The new developed payloads within spring4shell-scan bypasses several WAF vendors. Blog Post: #spring4shell #infosec #springshell0816
Nguyen The Duc@ducnt_Stable PoC for #Spring4Shell. Don't massive scan targets without knowledge about this, it can cause crash application in somehow 🙄👀 #bugbountytips #begbountytips
436146
Alvaro Muñoz@pwntester#Spring4Shell details are now public, It is an old ClassLoader Manipulation. Actually, CVE-2022-22965 is just a bypass of the 12 years old CVE-2010-1622 (581205- Local Spring Vulnerability Scanner a scanner by @_hillu that scans locally for instances vulnerable to #Spring4Shell
165149 
Snyk@snyksec⚠️ While #Spring4Shell doesn't appear to have the same impact as #Log4Shell, it should still be evaluated and prioritized by every organization using the Spring Framework. This post explores how the #ZeroDay #RCE vulnerability works and how to mitigate.0615
AG@MuirlandOracleNext time someone asks: "Can you make a lab for this Java vuln?", remind me to say no 😆 That was a cursed box to build, but all's well that ends well! Will be very interested to see if/how #Spring4Shell develops over time 👀TryHackMe @tryhackmeWe've released a new FREE lab demonstrating the recent Spring4Shell vulnerability (CVE-2022-22965)!🐚 🔴 Understand the vulnerability 🔴 Practice exploiting it via a web-based lab Explore the critical vulnerability in the Spring Java Framework 👉4471
We've released a new FREE lab demonstrating the recent Spring4Shell vulnerability (CVE-2022-22965)!🐚 🔴 Understand the vulnerability 🔴 Practice exploiting it via a web-based lab Explore the critical vulnerability in the Spring Java Framework 👉
776307
GreyNoise has not observed significant activity related to CVE-2022-22965, colloquially known as #Spring4Shell, since April 2, 2022.
0316- Snyk@snyksec🚨 There’s a credible #RCE vulnerability in spring-beans package, which is part of Spring Core. This is a key enabler of the inversion of control (IoC) capabilities of Spring — often referred to as dependency injection. #Spring4Shell #SpringShell (1/2) 👇21220
I think many early publications about #Spring4Shell / CVE-2022-22965 slightly glossed over the relationship between the underlying bug in Spring Beans and the exploitation path of this vulnerability through WebMVC / WebFlux (1/5) 🧵12253- First YARA rules to detect the PoC code and webshells dropped by the public POC exploiting the #Spring4Shell vulnerability Signature set of THOR Lite should be updated in a minute Thx to @xyantix @testanull Next step: log file based detection
1162308 - Pentester Academy@SecurityTube🧵 #Spring4Shell Vulnerability Explained Learn how a Java 9 architectural change led to a critical RCE vulnerability affecting millions of Spring applications. Includes technical deep dive, impact analysis, and actionable mitigation strategies.128969
Raj Samani@Raj_SamaniSpring4Shell: Zero-Day Vulnerability in Spring Framework (CVE-2022-22965) #cybersecurity #infosec #Spring4Shell054- Snyk@snyksec🚨 A fixed version for CVE-2022-22965 (#Spring4Shell) has been issued. At this time, we recommend upgrading to spring-beans version 5.2.20, 5.3.18, or higher and have updated our advisory published on Mar. 30:
0715 
3 lessons from #Spring4Shell: 1. Keep your dependencies up to date 2. Build pipeline where you can deploy in no time 3. Make jar not war424167- Snyk@snyksec😮💨 Catching up on #Spring4Shell? Learn more about the #Java RCE vulnerability and the recommended remediation actions. We’ll continue to provide updates through our vulnerability database and the blog as the situation evolves.1315
Ilkka Turunen@llkkaTGot together with @Ax_Sharma on a quick live stream to discuss what we know and don’t know about #springshell / #spring4shell037- Mehr Beiträge anzeigen
