About Spring4Shell CVE-2022-22965

It was recently confirmed that Spring4Shell has at least one RCE vulnerability in the Spring framerwork. Investigation is still in progress, and you can expect updates as analyses get further.

Is Kantega SSO Enterprise affected?

Kantega SSO Enterprise is built with JDK 8 packaged as a .jar, and we do not use spring-core, spring-webmvc or spring-webflux. From our intital analysis (Mar 31, 2022), Kantega SSO Enterprise is not affected by Spring4Shell CVE-2022-22965.

Is my Atlassian Data Center / Server system affected?

We recommend consulting with your security team and keep following updates on the CVE and Spring’s documentation for updates about more attack vectors, as well as updates and announcements from Atlassian’s security team. Keep checking for important security updates available on your system.
Atlassian has published security advisories here: https://confluence.atlassian.com/kb/faq-for-cve-2022-22963-cve-2022-22965-1115149136.html.

These are the requirements for being vulnerable from the specific scenario from the Spring report (as of Mar 31, 2022 20:30 CET):

• Running JDK 9 or higher

• Apache Tomcat as the Servlet container

• Packaged as WAR

• spring-webmvc or spring-webflux dependency:

  • Uses Spring MVC (5.3.15 and at least down to 4.3.0, possibly further)

• Endpoint using @RequestMapping, aka. Spring parameter binding

• Request parameter is of type object which maps to a POJO

  • Vulnerable: @NotNull DataObject data

  • Not vulnerable: @NotNull String string

Sources

• Atlassian announcement:https://confluence.atlassian.com/kb/faq-for-cve-2022-22963-cve-2022-22965-1115149136.html

• VMWare has published a CVE under CVE-2022-22965.

• You can read Spring’s public announcements here: Spring Framework RCE, Early Announcement.

• There is another article with in-depth analysis on how to test and patch for the weakness here: https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities/.