Snyk@snyksec
🚨 A fixed version for CVE-2022-22965 (#Spring4Shell) has been issued.
At this time, we recommend upgrading to spring-beans version 5.2.20, 5.3.18, or higher and have updated our advisory published on Mar. 30:
0715
Postări cu #Spring4Shell
#Spring4Shell
Postări publice de pe X care folosesc #Spring4Shell.
Hashtaguri înrudite
Nguyen The Duc@ducnt_Stable PoC for #Spring4Shell. Don't massive scan targets without knowledge about this, it can cause crash application in somehow 🙄👀 #bugbountytips #begbountytips
436146
FullHunt@FullHuntFullHunt developed spring4shell, an open-source tool for discovering spring4shell and Spring Cloud RCE at scale. The new developed payloads within spring4shell-scan bypasses several WAF vendors. Blog Post: #spring4shell #infosec #springshell0816
Ax Sharma@Ax_Sharma📢 AFTER much commotion and speculation Spring has *CONFIRMED* #SpringShell and in addition to a new release 5.3.18, also backported fix into 5.2.20. CVE pending. h/t @llkkaT #Spring4ShellAx Sharma @Ax_Sharma🆕 Spring has a NEW 5.3.18 release today (h/t @madpah @sonatype) that just hit Maven Central. Release touches the 'CachedIntrospectionResults' class—after 2 years. The same class that's stated to be responsible for #SpringShell and older CVE-2010-1622 💥139- Ax Sharma@Ax_Sharma@Ax_Sharma🆕 Spring has a NEW 5.3.18 release today (h/t @madpah @sonatype) that just hit Maven Central. Release touches the 'CachedIntrospectionResults' class—after 2 years. The same class that's stated to be responsible for #SpringShell and older CVE-2010-1622 💥
034 
LunaSec (@[email protected])@LunaSecIOVideo of one of LunaSec's security engineers (@breadchris) demonstrating an end-to-end POC of #spring4shell To replicate it yourself, go check out the #OpenSource repo on GitHub:2522- LunaSec (@[email protected])@LunaSecIOWe've published an analysis of the #Spring4Shell RCE to help provide better "facts" about what we know so far. There are 2 vulnerabilities and people are confusing them. Note: This post is Markdown on GitHub if you'd like to add anything (link in thread).3127262
NCSC IE@ncsc_gov_ie🚨 Please see NCSC alert regarding RCE vulnerability (CVE-2022-22965) that exists in Java Spring framework #Spring4Shell0511
Pentester Academy@SecurityTube🧵 New Blog: Spring4Shell Vulnerability Explained Learn how a Java 9 architectural change led to a critical RCE vulnerability affecting millions of Spring applications. Must-read for #Java devs & #AppSec teams #Spring4Shell #InfoSec0371.1K
Dynatrace@Dynatrace#AppSec is no joke, and with an updated CVSS score of 9.8, neither is #Spring4Shell. @robinwyss and @d_kaar explain this new vulnerability and outline two options to identify if your applications are impacted.
134
Ilkka Turunen@llkkaTGot together with @Ax_Sharma on a quick live stream to discuss what we know and don’t know about #springshell / #spring4shell037
Sander Maas@__RetrospectJava keeps me up at night… pushed a quick&dirty repo to help you replicate the spring core rce that got published: #spring4shell #springshell32998- Pentester Academy@SecurityTube🧵 #Spring4Shell Vulnerability Explained Learn how a Java 9 architectural change led to a critical RCE vulnerability affecting millions of Spring applications. Includes technical deep dive, impact analysis, and actionable mitigation strategies.128969
3 lessons from #Spring4Shell: 1. Keep your dependencies up to date 2. Build pipeline where you can deploy in no time 3. Make jar not war424167
Bojan Zdrnja@bojanzWell, it's showtime again. The #Spring4Shell exploit works, tested with Spring 5.2.3. We'll keep an eye on @sans_isc web site (getting late here).
1819
Checkmarx is closely monitoring #Spring4Shell and all other Spring vulnerabilities (CVE-2022-22963, CVE-2022-22950). Checkmarx SCA customers can scan their code for those vulnerabilities and get the latest remediation solutions. #springshell156
Alvaro Muñoz@pwntester#Spring4Shell details are now public, It is an old ClassLoader Manipulation. Actually, CVE-2022-22965 is just a bypass of the 12 years old CVE-2010-1622 (581205
CVE-2022-22965 (#Spring4Shell / #SpringShell), you can use OWASP Dependency Check to do a quick scan: mvn org.owasp:dependency-check-maven:aggregate This will generate a HTML report in the target folder (named dependency-check-report.html)2413- Snyk@snyksec⚠️ While #Spring4Shell doesn't appear to have the same impact as #Log4Shell, it should still be evaluated and prioritized by every organization using the Spring Framework. This post explores how the #ZeroDay #RCE vulnerability works and how to mitigate.0615
Raj Samani@Raj_SamaniSpring4Shell: Zero-Day Vulnerability in Spring Framework (CVE-2022-22965) #cybersecurity #infosec #Spring4Shell054
⛔️ Early this morning we started seeing buzz about a new remote code execution flaw that affects #SpringCore. Our Field CTO @llkkaT provides all the info on #Spring4Shell: 💭 What it is 💭 Everything you need to know 💭 Where to go from here ⛓️
11146- Arată mai multe postări
