The Spring Framework insecurely handles PropertyDescriptor objects, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.
The Spring Framework is a Java framework that can be used to create applications such as web applications. Due to improper handling of PropertyDescriptor objects used with data binding, Java applications written with Spring may allow for the execution of arbitrary code.
Exploit code that targets affected WAR-packaged Java code for tomcat servers is publicly available.
NCSC-NL has a list of products and their statuses with respect to this vulnerability.
By providing crafted data to a Spring Java application, such as a web application, an attacker may be able to execute arbitrary code with the privileges of the affected application. Depending on the application, exploitation may be possible by a remote attacker without requiring authentication.
Apply an update
This issue is addressed in Spring Framework 5.3.18 and 5.2.20. Please see the Spring Framework RCE Early Announcement for more details.
This issue was publicly disclosed by heige.
This document was written by Will Dormann
BMC Software Affected
JAMF software Affected
SAP SE Affected
Aruba Networks Not Affected
Check Point Not Affected
Commvault Not Affected
Elastic Not Affected
F5 Networks Not Affected
Jenkins Not Affected
Micro Focus Not Affected
Okta Inc. Not Affected
Palo Alto Networks Not Affected
Pulse Secure Not Affected
Red Hat Not Affected
salesforce.com Not Affected
SonarSource Not Affected
Trend Micro Not Affected
Ubiquiti Not Affected
Veritas Technologies Not Affected
Alphatron Medical Unknown
Extreme Networks Unknown
|Date First Published:||2022-03-31|
|Date Last Updated:||2022-05-19 16:09 UTC|