Spring4Shell Exposes Certain Spring Java Apps to Remote Code Execution

A newly disclosed vulnerability dubbed Spring4Shell or SpringShell affects certain Spring-based Java applications and could allow remote code execution under specific conditions. Reported prerequisites include use of the spring-beans library, Java 9+, and Tomcat 9+; successful exploitation may let an attacker write a malicious payload to disk for later execution. Public proof-of-concept code was released, increasing the risk of opportunistic testing against exposed systems.

The reporting distinguishes Spring4Shell from CVE-2022-22963, which affects Spring Cloud Function and is described as a separate issue rather than the same flaw. At the time covered by the references, there were no official reports of active exploitation in the wild and no official patch yet available, but defenders were provided public mitigation guidance and YARA detection rules to help identify vulnerable deployments and possible exploitation attempts.