Spring4Shell CVE-2022-22965 (Spring Framework data binding RCE on JDK 9+, CISA KEV): which apps are actually vulnerable and what versions fix it?

What it is: CVE-2022-22965 (Spring4Shell), disclosed March 31, 2022, lets a remote attacker use Spring MVC / WebFlux data binding to reach internal class properties and, in the known exploit path, write a web shell when the app runs as a WAR on Apache Tomcat with JDK 9 or later. It was exploited in the wild (including by Mirai-based botnets) and is in the CISA KEV catalog. Old Spring apps that were never upgraded still turn up in scans. Am I affected: - Spring Framework 5.3.0-5.3.17, 5.2.0-5.2.19, and older unsupported versions, used through spring-webmvc or spring-webflux. - The publicly known exploit needs all of: JDK 9+, the app packaged as a traditional WAR and deployed to a standalone Apache Tomcat, and controller methods that bind request parameters to plain objects (POJOs). Spring Boot executable JARs with embedded Tomcat were not vulnerable to that specific path, but Spring advised upgrading everyone because other paths might exist. - Check with mvn dependency:tree | grep spring-web or gradle dependencies, and the JDK version the app runs on. Fix: 1. Upgrade Spring Framework to 5.3.18+ or 5.2.20+ (Spring Boot 2.6.6+ or 2.5.12+ pull these in). Today, move to a currently supported Spring Framework 6.x / Spring Boot 3.x line, which also fixes many later CVEs. 2. If you can't upgrade quickly, Spring's documented interim options were: upgrade Tomcat to 10.0.20, 9.0.62 or 8.5.78 (which closed the known path), downgrade to Java 8, or restrict binding with a global @InitBinder that disallows class.*, Class.*, *.class.* and *.Class.* fields. 3. If an affected WAR was internet-facing, look for unexpected .jsp files in the Tomcat webapps directories (especially ROOT) and unusual Tomcat access log configuration changes, and rebuild the server if you find any. Verify: the deployed artifact contains spring-beans / spring-webmvc 5.3.18+ (or 6.x), and no unknown JSP files exist under webapps. Sources: https://spring.io/security/cve-2022-22965 https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement https://nvd.nist.gov/vuln/detail/CVE-2022-22965