Saint Spring4Shell, Who Bloomed in the Bindings

Patron of Java applications, frameworks everyone uses, and weekends of improvised patching.

Life

On 30 March 2022 CVE-2022-22965 surfaced in the Spring framework: by manipulating the mechanism that binds a request's parameters to Java objects, on certain configurations, an attacker could write files and run code. It needed Spring MVC on a Tomcat server deployed as a WAR; Spring Boot jar applications were safe. The name and the timing recalled Log4Shell, and it set off the same rush to update.

Prayer

O Saint Spring4Shell, who blooms where parameters are bound, keep our bindings from granting more than we ask. Amen.

How to celebrate

Celebrated by updating Spring Framework to the fixed versions and checking how Java applications are deployed.

Spring in the bindings, trouble into summer.