CISA Warns of Active Exploitation of Critical Spring4Shell Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA)
on Monday added the recently disclosed remote code execution (RCE)
vulnerability affecting the Spring Framework, to its Known Exploited Vulnerabilities
Catalog^[1] based on “evidence of
active exploitation.”

The critical severity flaw, assigned the identifier CVE-2022-22965^[2]
(CVSS score: 9.8) and dubbed “Spring4Shell”, impacts Spring
model–view–controller (MVC) and Spring WebFlux applications running
on Java Development Kit 9 and later.

“Exploitation requires an endpoint with DataBinder enabled
(e.g., a POST request that decodes data from the request body
automatically) and depends heavily on the servlet container for the
application,” Praetorian researchers Anthony Weems and Dallas Kaman
noted last week.

Although exact details of in-the-wild abuse remain unclear,
information security company SecurityScorecard said^[3]
“active scanning for this vulnerability has been observed coming
from the usual suspects like Russian and Chinese IP space.”

Similar scanning activities have been spotted by Akamai^[4]
and Palo Alto Networks’ Unit42^[5], with the attempts
leading to the deployment of a web shell for backdoor access and to
execute arbitrary commands on the server with the goal of
delivering other malware or spreading within the target
network.

According to statistics^[6]
released by Sonatype, potentially vulnerable versions of the Spring
Framework account for 81% of the total downloads from Maven Central
repository since the issue came to light on March 31.

Cisco, which is actively investigating^[7]
its line-up to determine which of them may be impacted by the
vulnerability, confirmed that three of its products are affected
–

• Cisco Crosswork Optimization Engine
• Cisco Crosswork Zero Touch Provisioning (ZTP), and
• Cisco Edge Intelligence

VMware, for its part, also has deemed three of its products as
vulnerable, offering patches and workarounds where applicable –

• VMware Tanzu Application Service for VMs
• VMware Tanzu Operations Manager, and
• VMware Tanzu Kubernetes Grid Integrated Edition (TKGI)

“A malicious actor with network access to an impacted VMware
product may exploit this issue to gain full control of the target
system,” VMware said^[8]
in the advisory.

Also added by CISA to the catalog are two zero-day flaws^[9]
patched by Apple last week (CVE-2022-22674 and CVE-2022-22675) and
a critical shortcoming in D-Link routers (CVE-2021-45382) that has
been actively weaponized by the Beastmode^[10] Mirai-based DDoS
campaign.

Pursuant to the Binding Operational Directive (BOD) issued^[11] by CISA in November
2021, Federal Civilian Executive Branch (FCEB) agencies are
required to remediate the identified vulnerabilities by April 25,
2022.