WhiteSource releases free tool to detect and remediate Spring4Shell vulnerability

WhiteSource launched WhiteSource Spring4Shell Detect, a free command-line interface (CLI) tool that quickly scans projects to find vulnerable open source libraries for CVE-2022-22965, also known as Spring4Shell.

Spring4Shell is a remote code execution (RCE) vulnerability in Spring, one of the most popular open-source frameworks for Java applications in use today. While we are still learning about this vulnerability, its impact is likely on par with that of Log4j and it is considered extremely critical with a severity score of 9.8. WhiteSource’s free developer tool, which is available now on GitHub, provides developers with the exact path to direct and indirect dependencies, along with the fixed version, for speedy remediation.

“Organizations and security teams must approach Spring4Shell with the same attention and urgency they did with the recent Log4j vulnerability,” said Rami Sass, CEO, WhiteSource. “This vulnerability highlights the importance of a proactive approach to software security and the need for more automated application security to be baked into the development lifecycle. Ensure you are handling your technical debt, and update.”

Given the potential widespread impact and risk of this zero-day vulnerability, WhiteSource recommends organizations take the following steps to address and prevent similar instances in the future:

• Inventory your entire application list to identify all instances of CVE-2022-22965. This can be done using WhiteSource’s free detection tool.
• Update your vulnerable versions of Spring Framework to the latest version. Use tools such as WhiteSource Renovate, which can automatically update your libraries with the latest available fixes.
• Generate a software bill of materials (SBOM) for all applications in your environment. An SBOM provides visibility to your entire software attack surface — both direct and transitive dependencies — and helps you react quickly to vulnerability announcements.

WhiteSource Renovate, which has more than one hundred million downloads, automatically updates dependencies and has already identified and mitigated the Spring4Shell vulnerability for tens of thousands of enterprises around the world.