The Cybersecurity and Infrastructure Security Agency has added the Spring4Shell remote code execution vulnerability impacting the Spring Framework to its Known Exploited Vulnerabilities Catalog, VentureBeat reports.
Federal agencies have been urged by CISA to patch the critical flaw, tracked as CVE-2022-22965, by April 25. Spring noted that several requirements have to be met, including the use of Apache Tomcat, for the bug to be exploited. Meanwhile, VMware has already issued patches to address the Spring4Shell vulnerability in its VMware Tanzu Application Service for VMs, VMware Tanzu Operations Manager, and VMware Tanzu Kubernetes Grid Integrated Edition. "A malicious actor with network access to an impacted VMware product may exploit this issue to gain full control of the target system," said VMware. However, fixes for impacted TKGI versions are yet to be issued. While numerous deployments may have been impacted by Spring4Shell, mitigating circumstances have limited vulnerable deployments, according to Sonatype Field Chief Technology Officer Ilkka Turunen. "That said, with any big project, there is a ton of legacy out there that can result in older and unmaintained systems becoming potential entry points," Turunen said.
Included in the exposed dataset labeled "PDL" were individuals' full names, email addresses, phone numbers, location data, professional summaries, and skills, as well as education and employment histories.
Attackers could leverage the issue — which impacts Nexus 3000, 7000, and 9000 series switches with vulnerable NX-OS versions with DHCPv6 activated and are in standalone NX-OS mode — to facilitate continuous crashes of the dhcp_snoop process and a denial-of-service condition.
Higher rewards of up to $250,000 will be given by Google for the discovery of memory corruption flaws in the Chrome browser shown to achieve remote code execution using a non-sandboxed process as part of a more robust vulnerability reward program.