Enable your security and operations teams to proactively identify, prioritize, and remediate exposures to stay ahead of attackers.
Watch a Demo
The expansion of an organization's attack surface continues to present a critical business challenge. Download the GigaOm Radar for Attack Surface Management to get an overview of the available ASM solutions, identify leading offerings, and evaluate the best solution for you. More...
The CyCognito platform helps you identify all of the attacker-exposed assets in your IT ecosystem for a complete view of your attack surface.
Download CyCognito’s State of External Exposure Management Report to learn key recommendations that your Security teams can implement to improve their exposure management strategy and minimize risk. More...
External attack surface management is advancing cybersecurity into a new era. Learn how security experts across all industries benefit from using CyCognito’s platform.
Read The Total Economic Impact™ of The CyCognito Platform — a Forrester study. Cost Savings And Business Benefits Enabled By The CyCognito Platform. More...
We believe all organizations should be able to protect themselves from even the most sophisticated attackers.
Contact us
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the recently disclosed remote code execution (RCE) vulnerability affecting the Spring Framework, to its Known Exploited Vulnerabilities Catalog based on “evidence of active exploitation.”
The critical severity flaw was assigned the identifier CVE-2022-22965 (CVSS score: 9.8) and dubbed “SpringShell”.
The Spring framework provides a comprehensive set of extensions and third-party libraries that let developers build applications. The Spring Framework is described as the “most widely used lightweight open-source framework for Java.”
The Spring4Shell or SpringShell vulnerability affects Spring MVC, and Spring WebFlux applications running Java Development Kit (JDK) version 9 and higher, and Apache Tomcat version 9 and higher may be vulnerable to remote code execution (RCE) through data-binding. The application can run Tomcat as a WAR deployment. Applications deployed as a Spring Boot executable jar are not vulnerable.
Proof of Concepts exists suggesting that the vulnerability is exploitable and high risk.
Impacted systems have the following traits:
Also please note that there is a specific configuration (not default) needed for this vulnerability to be exploited.
It is possible to detect exposed Spring Boot servers instances using a favicon hash.
An easy and safe method exists for the identified Spring Boot instances to validate if the instance is exploitable using a simple HTTP request.
More information is available here.
Another detection option is the Nueculi Community Vulnerability Scanner which has a template for detecting the vulnerability, and the template can be found here.
CyCognito platform automates the discovery of Spring Boot servers and validates if they are exploitable.
Stay tuned! CyCognito will continue updating you as more news about this vulnerability unfolds.
Download CyCognito’s State of External Exposure Management Report to learn key recommendations that your Security teams can implement to improve their exposure management strategy and minimize risk.
As your attack surface has grown to cloud infrastructures and across subsidiaries, attackers are looking for and finding unknown and unmanaged assets to serve as their entry points.
Request a personalized walkthrough of the CyCognito platform to see how we can help your company identify all its internet-exposed assets, focus on which are most vulnerable to attacks, and accelerate your time to remediating critical risks.
CyCognito solves one of the most fundamental business problems in cybersecurity: seeing how attackers view your organization, where they are most likely to break in, what systems and assets are at risk and how you can eliminate the exposure.
Founded by national intelligence agency veterans, CyCognito has a deep understanding of how attackers exploit blind spots and a path of least resistance. Based in Palo Alto, CyCognito serves a number of large enterprises and Fortune 500 organizations, including Colgate-Palmolive, Tesco and many others.
For more information, follow us on Twitter @cycognito.
Privacy Policy Terms of Service Sitemap