Is my system affected by spring4shell vulnerability if it uses Java 8?
Configuration
java 8
Spring version : 3.1.3.RELEASE
Packaged as executable WAR
Deployed on tomcat server
Spring4Shell- CVE-2022-22965 is the application vulnerable if using Java 8?
Viewed 1177
2 Answers
No as in Java 8 you have no Class#getModule() (and getClassLoader() later on) method which is used to exploit this vulnerability.
Read more here https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement#am-i-impacted
Currently the exploit or POC which is available works with this configuration
- JDK 9 or higher
- Have Apache Tomcat as the servlet container
- Be packaged as a traditional WAR
- Use the spring-webmvc or spring-webflux dependency
- Use Spring framework versions 5.3.0 to 5.3.17, 5.2.0 to 5.2.19, or older versions
So coming to your question you check 3 out of 4, so currently no... but as researchers quote other configuration may be exploitable as well, as someone might find a way to exploit so for now it's better to start upgrading spring version to the latest.
Related