Spring Core and Cloud Function SpEL RCEs

Details
Content
Dependencies
Version History

This pack handles Spring Core and Cloud Function SpEL RCEs, a 0-days exploits in the popular Spring Framework.

This pack is part of the Rapid Breach Response pack.

Critical RCE vulnerabilities in Spring Core and Cloud Function SpEL refers to two 0-day exploits in the popular Spring framework.

Spring Framework is an extremely popular framework used by Java developers to build modern applications. If you rely on the Java stack, it is very likely that your development teams use Spring. In some cases, a single specially crafted request is enough to exploit the vulnerability.

Later, it was discovered that these are two separate vulnerabilities, one in Spring Core and the other in Spring Cloud Function:

CVE-2022-22965 - RCE in "Spring Core" is a severe vulnerability, aka Spring4Shell

CVE-2022-22963 - RCE in "Spring Cloud Function SpEL"

CVE-2022-22947 - RCE in "Spring Cloud Gateway"

Spring Core vulnerability requirements:

JDK 9 or higher
Apache Tomcat as the Servlet container
Packaged as WAR
spring-webmvc or spring-webflux dependency
Spring Framework versions 5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and older versions

Spring Cloud Function unaffected versions:

3.1.7
3.2.3

This pack will provide you with a first response kit which includes:

Hunting
Remediation
Mitigations

More information about the vulnerability:

CVE-2022-22965: Spring Core Remote Code Execution Vulnerability Exploited In the Wild

Note: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve.

Spring Core and Cloud Function SpEL RCEs

This pack is part of the Rapid Breach Response pack.

Critical RCE vulnerabilities in Spring Core and Cloud Function SpEL refers to two 0-day exploits in the popular Spring framework.

Later, it was discovered that these are two separate vulnerabilities, one in Spring Core and the other in Spring Cloud Function:

CVE-2022-22965 - RCE in "Spring Core" is a severe vulnerability, aka Spring4Shell

CVE-2022-22963 - RCE in "Spring Cloud Function SpEL"

CVE-2022-22947 - RCE in "Spring Cloud Gateway"

Spring Core vulnerability requirements:

JDK 9 or higher
Apache Tomcat as the Servlet container
Packaged as WAR
spring-webmvc or spring-webflux dependency
Spring Framework versions 5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and older versions

Spring Cloud Function unaffected versions:

3.1.7
3.2.3

This pack will provide you with a first response kit which includes:

Hunting
Remediation
Mitigations

More information about the vulnerability:

CVE-2022-22965: Spring Core Remote Code Execution Vulnerability Exploited In the Wild

Spring Core and Cloud Function SpEL RCEs

Playbooks

Name	Description
Spring Core and Cloud Function SpEL RCEs	On March 29, 2022, information about a 0-day vulnerability in the popular Java library Spring Core appeared on Twitter. Spring Framework is an extremely popular framework used by Java developers to build modern applications. If you rely on the Java stack, it is very likely that your development teams use Spring. In some cases, a single specially crafted request is enough to exploit the vulnerability. Later, it was discovered that these are two separate vulnerabilities, one in Spring Core and the other in Spring Cloud Function: CVE-2022-22965 - RCE in "Spring Core" is a severe vulnerability, aka Spring4Shell CVE-2022-22963 - RCE in "Spring Cloud Function SpEL" CVE-2022-22947 - RCE in "Spring Cloud Gateway" Spring Core vulnerability requirements: JDK 9 or higher Apache Tomcat as the Servlet container Packaged as WAR spring-webmvc or spring-webflux dependency Spring Framework versions 5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and older versions Spring Cloud Function unaffected versions: 3.1.7 3.2.3 This playbook will provide you with a first response kit which includes: Hunting Panorama Prisma Cloud Compute XDR XQL queries - set the playbook input RunXQLHuntingQueries to 'True' if you would like the XQL to be executed via the playbook. XDR Alerts - Search for new incidents including one or more of Spring RCEs dedicated Cortex XDR signatures Remediation Mitigations Note: You can execute this playbook using the Incidents view by creating a new incident or by using a dedicated job to schedule the playbook execution. Additional resources: Spring Framework RCE CVE-2022-22965: Spring Core Remote Code Execution Vulnerability Exploited In the Wild

Name

Description

Spring Core and Cloud Function SpEL RCEs

On March 29, 2022, information about a 0-day vulnerability in the popular Java library Spring Core appeared on Twitter.

Later, it was discovered that these are two separate vulnerabilities, one in Spring Core and the other in Spring Cloud Function:

CVE-2022-22965 - RCE in "Spring Core" is a severe vulnerability, aka Spring4Shell

CVE-2022-22963 - RCE in "Spring Cloud Function SpEL"

CVE-2022-22947 - RCE in "Spring Cloud Gateway"

Spring Core vulnerability requirements:

JDK 9 or higher
Apache Tomcat as the Servlet container
Packaged as WAR
spring-webmvc or spring-webflux dependency
Spring Framework versions 5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and older versions

Spring Cloud Function unaffected versions:

3.1.7
3.2.3

This playbook will provide you with a first response kit which includes:

Hunting
- Panorama
- Prisma Cloud Compute
- XDR XQL queries - set the playbook input RunXQLHuntingQueries to 'True' if you would like the XQL to be executed via the playbook.
- XDR Alerts - Search for new incidents including one or more of Spring RCEs dedicated Cortex XDR signatures
Remediation
Mitigations

Note: You can execute this playbook using the Incidents view by creating a new incident or by using a dedicated job to schedule the playbook execution.

Additional resources:

Spring Framework RCE

CVE-2022-22965: Spring Core Remote Code Execution Vulnerability Exploited In the Wild

Playbooks

Name	Description
Spring Core and Cloud Function SpEL RCEs	On March 29, 2022, information about a 0-day vulnerability in the popular Java library Spring Core appeared on Twitter. Spring Framework is an extremely popular framework used by Java developers to build modern applications. If you rely on the Java stack, it is very likely that your development teams use Spring. In some cases, a single specially crafted request is enough to exploit the vulnerability. Later, it was discovered that these are two separate vulnerabilities, one in Spring Core and the other in Spring Cloud Function: CVE-2022-22965 - RCE in "Spring Core" is a severe vulnerability, aka Spring4Shell CVE-2022-22963 - RCE in "Spring Cloud Function SpEL" CVE-2022-22947 - RCE in "Spring Cloud Gateway" Spring Core vulnerability requirements: JDK 9 or higher Apache Tomcat as the Servlet container Packaged as WAR spring-webmvc or spring-webflux dependency Spring Framework versions 5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and older versions Spring Cloud Function unaffected versions: 3.1.7 3.2.3 This playbook will provide you with a first response kit which includes: Hunting Panorama Prisma Cloud Compute XDR XQL queries - set the playbook input RunXQLHuntingQueries to 'True' if you would like the XQL to be executed via the playbook. XDR Alerts - Search for new alerts including one or more of Spring RCEs dedicated Cortex XDR signatures Remediation Mitigations Note: You can execute this playbook using the Alerts view by creating a new alert or by using a dedicated job to schedule the playbook execution. Additional resources: Spring Framework RCE CVE-2022-22965: Spring Core Remote Code Execution Vulnerability Exploited In the Wild

Name

Description

Spring Core and Cloud Function SpEL RCEs

On March 29, 2022, information about a 0-day vulnerability in the popular Java library Spring Core appeared on Twitter.

Later, it was discovered that these are two separate vulnerabilities, one in Spring Core and the other in Spring Cloud Function:

CVE-2022-22965 - RCE in "Spring Core" is a severe vulnerability, aka Spring4Shell

CVE-2022-22963 - RCE in "Spring Cloud Function SpEL"

CVE-2022-22947 - RCE in "Spring Cloud Gateway"

Spring Core vulnerability requirements:

JDK 9 or higher
Apache Tomcat as the Servlet container
Packaged as WAR
spring-webmvc or spring-webflux dependency
Spring Framework versions 5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and older versions

Spring Cloud Function unaffected versions:

3.1.7
3.2.3

This playbook will provide you with a first response kit which includes:

Hunting
- Panorama
- Prisma Cloud Compute
- XDR XQL queries - set the playbook input RunXQLHuntingQueries to 'True' if you would like the XQL to be executed via the playbook.
- XDR Alerts - Search for new alerts including one or more of Spring RCEs dedicated Cortex XDR signatures
Remediation
Mitigations

Note: You can execute this playbook using the Alerts view by creating a new alert or by using a dedicated job to schedule the playbook execution.

Additional resources:

Spring Framework RCE

CVE-2022-22965: Spring Core Remote Code Execution Vulnerability Exploited In the Wild

Required Content Packs (3)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Rapid Breach Response	By: Cortex XSOAR

Optional Content Packs (5)

Pack Name	Pack By
Common Playbooks	By: Cortex XSOAR
Cortex XDR by Palo Alto Networks	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
PAN-OS by Palo Alto Networks	By: Cortex XSOAR
Prisma Cloud by Palo Alto Networks	By: Cortex XSOAR

All level dependencies (14)

Pack Name	Pack By
Asset	By: Cortex XSOAR
Base	By: Cortex XSOAR
Splunk	By: Cortex XSOAR
Common Types	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Ransomware	By: Cortex XSOAR
Malware Core	By: Cortex XSOAR
Rapid Breach Response	By: Cortex XSOAR
Cryptocurrency	By: Cortex XSOAR
Access Investigation	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR
Rasterize	By: Cortex XSOAR
IBM QRadar	By: Cortex XSOAR
Identity	By: Cortex XSOAR

1.0.4 - R1738579 (December 2, 2024)

Playbooks

Spring Core and Cloud Function SpEL RCEs

Added command prisma-cloud-config-search to replace soon to be EOL command redlock-get-rql-response. The command redlock-get-rql-response will reach its end of life (EOL) at: Nov 01, 2023, Please use the integration Prisma Cloud v2 instead.

Related pull requests:
- 26581

Download

1.0.3 - R5170573 (May 2, 2023)

Playbooks

Spring Core and Cloud Function SpEL RCEs

Documentation and metadata improvements.

Related pull requests:
- 23716

Download

1.0.2 - R4718798 (March 1, 2023)

Playbooks

Spring Core and Cloud Function SpEL RCEs

Added a Prisma Cloud query to locate vulnerable cloud hosts that are receiving traffic.
Added XDR query to search for alerts related to the Spring RCEs.

Related pull requests:
- 18473

Download

1.0.1 - 2704575 (April 5, 2022)

Playbooks

Spring Core and Cloud Function SpEL RCEs

Added coverage for the Threat Hunting phase using:
- Prisma Cloud Compute
- XDR XQL queries

Download

1.0.0 - 2689877 (April 2, 2022)

This pack handles Spring Core and Cloud Function SpEL RCEs, a 0-days exploits in the popular Spring Framework.

Download

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Cortex
Created	April 2, 2022
Last Release	December 2, 2024

Malware

WORKS WITH THE FOLLOWING INTEGRATIONS:

Palo Alto Networks Cortex XDR - Investigation and Response

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.