CVE-2022-22965: 
Oracle WebLogic Server vulnerability analysis and mitigation

Spring Framework vulnerability (CVE-2022-22965) is a critical remote code execution (RCE) vulnerability that affects Spring MVC and Spring WebFlux applications running on JDK 9+ via data binding. The vulnerability was discovered and reported to VMware on March 31, 2022, by codeplutos and meizjm3i of AntGroup FG Security Lab, with a secondary report from Praetorian (Spring Security, NVD).

The vulnerability exists in Spring Framework versions 5.3.0 to 5.3.17 and 5.2.0 to 5.2.19. It specifically requires the following conditions: JDK 9 or higher, Apache Tomcat as the Servlet container, application packaged as WAR, and spring-webmvc or spring-webflux dependency. The vulnerability occurs when special objects or classes are exposed under certain conditions during data binding, allowing attackers to access and manipulate class objects through property chains. The vulnerability has a CVSS v3.1 base score of 9.8 (Critical) (Spring Security, NVD).

A successful exploitation allows remote attackers to execute arbitrary code on vulnerable systems with the privileges of the affected application. If the application is deployed as a Spring Boot executable jar (the default), it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it (Spring Security).

The primary mitigation is to upgrade to Spring Framework versions 5.3.18+ or 5.2.20+. For applications that cannot upgrade, alternative mitigations include: upgrading to Apache Tomcat versions 10.0.20, 9.0.62, or 8.5.78, downgrading to Java 8, or implementing a disallowedFields property in WebDataBinder to block dangerous class property access (Spring Security).

The vulnerability gained significant attention in the cybersecurity community, being dubbed "Spring4Shell". Multiple security vendors and researchers published analyses and detection methods. Organizations like Cisco, VMware, and other major vendors quickly released security advisories and patches for their affected products (Cisco Advisory).