– On servers housing the Spring framework, users may run the ‘java-version’ command to check the currently installed version. If the version number is <= 8, the vulnerability is not present.
– In order to identify if the Spring framework is in use, users may run the following command on Linux systems: find -type f -iname 'spring-beans-*.jar'
– If 'spring-beans-*.jar' does not exist, another file may exist that indicates Spring framework usage. Search for the existence of the related class file using the following commands on linux systems: find /path/to/decompression/directory -type f -iname 'CachedIntrospectionResults.class'

If the environment runs Java independently using jar packages, users may unzip the jar file and then change into the unzipped directory and run the above commands to find related Spring objects.

There are no current patches for this vulnerability at this time. In this case, it is recommended to use the following solutions for temporary protection of the environment until the patch has been released.

– Search the @InitBinder annotation globally in the application to see if the dataBinder.setDisallowedFields method is called in the method body. If the introduction of this code snippet is found, add {"class.*","Class.* to the original blacklist ","*.class.*", "*.Class.*"}. (Note: If this code snippet is used a lot, it needs to be appended everywhere)

– Create the following global class under the project package of the application system and ensure that this class is loaded by Spring (it is recommended to add it in the package where the Controller is located). After the class is added, the project needs to be recompiled and packaged, and tested for functional verification. Then republish the project.

import org.springframework.core.annotation.Order;
import org.springframework.web.bind.WebDataBinder;
import org.springframework.web.bind.annotation.ControllerAdvice;
import org.springframework.web.bind.annotation.InitBinder;
@ControllerAdvice
@Order(10000)
public class GlobalControllerAdvice{
@InitBinder
public void setAllowedFields(webdataBinder dataBinder){
String[]abd=new string[]{"class.*","Class.*","*.class.*","*.Class.*"};
dataBinder.setDisallowedFields(abd);
}
}

https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html

https://github.com/lunasec-io/spring-rce-vulnerable-app

https://bugalert.org/content/notices/2022-03-29-spring.html

We're taking a look into the "possible RCE in Spring Core" that's been circulating around. From looking at the commits in Spring it seems like it has many mitigating factors, but we'll follow up with more details soon. https://t.co/u58FfMB5di

— LunaSec (@LunaSecIO) March 30, 2022