#Spring4Shell

FullHunt developed spring4shell, an open-source tool for discovering spring4shell and Spring Cloud RCE at scale. The new developed payloads within spring4shell-scan bypasses several WAF vendors. Blog Post: #spring4shell #infosec #springshell

We've published an analysis of the #Spring4Shell RCE to help provide better "facts" about what we know so far. There are 2 vulnerabilities and people are confusing them. Note: This post is Markdown on GitHub if you'd like to add anything (link in thread).

Checkmarx is closely monitoring #Spring4Shell and all other Spring vulnerabilities (CVE-2022-22963, CVE-2022-22950). Checkmarx SCA customers can scan their code for those vulnerabilities and get the latest remediation solutions. #springshell

3 lessons from #Spring4Shell: 1. Keep your dependencies up to date 2. Build pipeline where you can deploy in no time 3. Make jar not war

New emergent threat response: “#Spring4Shell: Zero-Day Vulnerability in Spring Framework (CVE-2022-22965).” Read our blog overview of what you need to know ⤵️ Note: we will continue to update this blog as more information becomes available.

🧵 New Blog: Spring4Shell Vulnerability Explained Learn how a Java 9 architectural change led to a critical RCE vulnerability affecting millions of Spring applications. Must-read for #Java devs & #AppSec teams #Spring4Shell #InfoSec

Update: #Spring4Shell is now CVE-2022-22965, with a HIGH CVSS score of 8.1

Update: Confused about the various #spring vulnerabilities out there? Check out our latest blog with technical analysis of all three CVEs, their affected versions, and mitigations. #spring4shell #springshell

Well, it's showtime again. The #Spring4Shell exploit works, tested with Spring 5.2.3. We'll keep an eye on @sans_isc web site (getting late here).

Spring4Shell: Zero-Day Vulnerability in Spring Framework (CVE-2022-22965) #cybersecurity #infosec #Spring4Shell

@th3_protoCOL First YARA rules to detect the PoC code and webshells dropped by the public POC exploiting the #Spring4Shell vulnerability Signature set of THOR Lite should be updated in a minute Thx to @xyantix @testanull Next step: log file based detection

🧵 #Spring4Shell Vulnerability Explained Learn how a Java 9 architectural change led to a critical RCE vulnerability affecting millions of Spring applications. Includes technical deep dive, impact analysis, and actionable mitigation strategies.

⛔️ Early this morning we started seeing buzz about a new remote code execution flaw that affects #SpringCore. Our Field CTO @llkkaT provides all the info on #Spring4Shell: 💭 What it is 💭 Everything you need to know 💭 Where to go from here ⛓️

Join @SGgrc & @leolaporte for a breakdown of Microsoft’s new #Autopatch system, the #Spring4Shell vulnerability, and the 0-Day in NGINX - “the Internet’s most used webserver platform!”  Hear the latest #cybersecurity news and subscribe on @pocketcasts

GreyNoise has not observed significant activity related to CVE-2022-22965, colloquially known as #Spring4Shell, since April 2, 2022.

#Spring4Shell (CVE-2022-22965) Remote Code Execution (RCE) was discovered in Spring Core running JDK version 9 (or later). We’ve created a lab to show you how to exploit the #vulnerability. Watch, then get more exploits here: #demo #java .

Incoming guys! xD #spring4shell #springcore #rce #vulnerability #vulnerabilitymanagement

Video of one of LunaSec's security engineers (@breadchris) demonstrating an end-to-end POC of #spring4shell To replicate it yourself, go check out the #OpenSource repo on GitHub:

A new zero-day Remote Code Execution (RCE) vulnerability, known as “#Spring4Shell” or “SpringShell” was disclosed in the Spring framework. Learn about the authenticated QIDs to address this vulnerability from the Qualys Research Team:

My initial notes on #spring4shell