Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsSpring4Shell is the name commonly used for CVE-2022-22965, a critical remote-code-execution vulnerability in Spring Framework’s data binding. The documented exploit scenario affects certain Spring MVC or Spring WebFlux applications running on JDK 9 or later, with Tomcat and WAR packaging. If your application uses an affected Spring Framework version, upgrade to the corresponding fixed release or follow your product vendor’s security update, then investigate logs for possible compromise. A version number alone does not settle every deployment’s risk.
What Spring4Shell is
Spring’s advisory names CVE-2022-22965 “Spring Framework RCE via Data Binding on JDK 9+.” In the documented scenario, crafted HTTP request data can reach sensitive application internals through data binding in Spring MVC or Spring WebFlux. Microsoft’s analysis describes how the proof of concept changed Tomcat access-log settings to write a JSP web shell into a path accessible to the application. Spring’s advisory and Microsoft’s analysis explain the scenario.
The National Vulnerability Database (NVD) assigns CVE-2022-22965 a CVSS 3.1 base score of 9.8, Critical, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. NVD also records it in CISA’s Known Exploited Vulnerabilities Catalog. The catalog entry’s April 4, 2022 addition date and April 25, 2022 due date are historical context, not a current remediation deadline. Severity and catalog status do not prove that a particular system is affected or compromised. NVD’s CVE entry has the score and catalog details.
How to tell whether an application may be affected
Establish the framework version and the way the application is built and deployed. Spring’s published affected ranges are Spring Framework 5.3.0 through 5.3.17, and 5.2.19.RELEASE and earlier. Its listed fixed versions are 5.3.18 and 5.2.20.RELEASE. These are the ranges and fixes in the March 31, 2022 Spring advisory; for later releases or vendor-managed products, check the responsible vendor’s current advisory rather than assuming that this historical range is the complete answer.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →#1 Best Overall
Check the documented exploit prerequisites
The specific exploit scenario described by Spring requires all of the following:
- JDK 9 or later;
- Apache Tomcat as the servlet container;
- WAR packaging; and
- a dependency on spring-webmvc or spring-webflux.
Spring says: “If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit.” That statement is limited to the specific exploit scenario in the advisory. Spring also warns that the underlying vulnerability may have other ways to be exploited, so an executable JAR should not be treated as proof that every configuration is safe. Read the qualification in Spring’s advisory.
Identify dependencies and vendor-managed components
Inspect dependency declarations, resolved dependency trees, packaged artifacts, and deployment configuration to determine the exact Spring Framework version, JDK, web stack, servlet container, and packaging. A framework may also be included transitively or inside a commercial product. If a supplier manages the application or product, ask whether it uses Spring Core and follow its specific security update and remediation instructions. NCSC-NL recommends checking with suppliers and warns that scanner results do not guarantee that vulnerable systems are absent. See NCSC-NL’s operational guidance.
How to fix Spring4Shell
Upgrade Spring Framework directly
- Identify the affected Spring Framework line in the application’s resolved dependencies.
- Upgrade to the corresponding Spring-listed fixed version: 5.3.18 for the 5.3 line, or 5.2.20.RELEASE for the 5.2 line, as specified in the advisory.
- Rebuild and redeploy the application using your normal release process, then verify that the deployed artifact contains the updated framework version.
- Check for any additional product-specific update or instructions if the application is part of a vendor-managed distribution.
Spring states that after upgrading to the listed fixed versions, no other steps are necessary for this vulnerability; it also links mitigation guidance for applications unable to upgrade. Because product packaging and later vendor releases can differ, follow the applicable product advisory where one exists. Spring’s advisory includes the upgrade and mitigation guidance.
Rank #3
If an immediate upgrade is not possible
Use the temporary mitigation steps linked from Spring’s advisory and coordinate a supported update with the application or product owner. Do not treat a mitigation, a scanner result, a WAF rule, or a deployment assumption as equivalent to installing the vendor’s fix. Keep the affected service under heightened review while the permanent remediation is pending.
Check for possible compromise separately
Patching removes the known vulnerable code path addressed by the update; it does not establish that the application was never exploited. NCSC-NL advises reviewing logs on both vulnerable and already-patched systems. Look for suspicious requests or unexpected changes consistent with the deployment, and investigate any unexpected JSP files or other artifacts in application-accessible locations. The proof-of-concept behavior Microsoft described involved altered Tomcat access-log settings and writing a JSP web shell, but that example is not a complete list of indicators.
If you find evidence suggesting unauthorized access, use your organization’s incident-response process. Determine the affected systems and data and assess credentials according to your established procedures. The appropriate containment and recovery steps depend on the deployment; the cited guidance does not prescribe one universal post-incident checklist.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What scanning and request probes can—and cannot—tell you
NCSC-NL lists scanning tools but cautions that a scan cannot guarantee that no vulnerable systems exist. Inventory dependencies and deployment details alongside scanning, and verify vendor-managed components with their suppliers.
Recommended Free Tools
Best Value
Microsoft described a non-malicious request test as an indicator for susceptibility to the published proof of concept. It is not a comprehensive security test: systems within the impacted-system scope should still be treated as vulnerable and remediated. Microsoft also documents Defender, firewall, and WAF detection options; those are product-specific controls, not substitutes for the software fix. Consult Microsoft’s guidance for its detection details.
ScreenshotNeo is not a Spring4Shell remediation
ScreenshotNeo is a website screenshot API and MCP server for developers. It does not identify, patch, or investigate Spring4Shell. If you separately need automated website captures for a development workflow, see ScreenshotNeo; do not use screenshot tooling as a vulnerability scanner or incident-response control.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
