Security News > 2022 > March > Unpatched Java Spring Framework 0-Day RCE Bug Threatens Enterprise Web Apps Security

A zero-day remote code execution vulnerability has come to light in the Spring framework shortly after a Chinese security researcher briefly leaked a proof-of-concept exploit on GitHub before deleting their account.

According to cybersecurity firm Praetorian, the unpatched flaw impacts Spring Core on Java Development Kit versions 9 and later and is a bypass for another vulnerability tracked as CVE-2010-1622, enabling an unauthenticated attacker to execute arbitrary code on the target system.

Spring is a software framework for building Java applications, including web apps on top of the Java EE platform.

It's worth noting that the flaw targeted by the zero-day exploit is different from two previous vulnerabilities disclosed in the Spring framework this week, including the Spring Framework expression DoS vulnerability and the Spring Cloud expression resource access vulnerability.

Initial analysis of the new code execution flaw in Spring Core suggests that its impact may not be severe.

"[C]urrent information suggests in order to exploit the vulnerability, attackers will have to locate and identify web app instances that actually use the DeserializationUtils, something already known by developers to be dangerous," Flashpoint said in an independent analysis.

News URL

https://thehackernews.com/2022/03/unpatched-java-spring-framework-0-day.html