• Home
  • Newsroom
  • WhiteSource Launches Free Developer Tool to Detect and Remediate Spring4Shell Vulnerability

WhiteSource Launches Free Developer Tool to Detect and Remediate Spring4Shell Vulnerability

Developer tool now available for use on GitHub

TEL AVIV AND BOSTON – April 1, 2022WhiteSource, a leader in application security, today launched WhiteSource Spring4Shell Detect, a free command-line interface (CLI) tool that quickly scans projects to find vulnerable open source libraries for CVE-2022-22965, also known as Spring4Shell.

Spring4Shell is a remote code execution (RCE) vulnerability in Spring, one of the most popular open-source frameworks for Java applications in use today. While we are still learning about this vulnerability, its impact is likely on par with that of Log4j and it is considered extremely critical with a severity score of 9.8. WhiteSource’s free developer tool, which is available now on GitHub, provides developers with the exact path to direct and indirect dependencies, along with the fixed version, for speedy remediation. 

“Organizations and security teams must approach Spring4Shell with the same attention and urgency they did with the recent Log4j vulnerability,” said Rami Sass, CEO, WhiteSource. “This vulnerability highlights the importance of a proactive approach to software security and the need for more automated application security to be baked into the development lifecycle. Ensure you are handling your technical debt, and update.”

Given the potential widespread impact and risk of this zero-day vulnerability, WhiteSource recommends organizations take the following steps to address and prevent similar instances in the future:

  • Inventory your entire application list to identify all instances of CVE-2022-22965. This can be done using WhiteSource’s free detection tool.
  • Update your vulnerable versions of Spring Framework to the latest version. Use tools such as WhiteSource Renovate, which can automatically update your libraries with the latest available fixes.
  • Generate a software bill of materials (SBOM) for all applications in your environment. An SBOM provides visibility to your entire software attack surface — both direct and transitive dependencies — and helps you react quickly to vulnerability announcements.

WhiteSource Renovate, which has more than one hundred million downloads, automatically updates dependencies and has already identified and mitigated the Spring4Shell vulnerability for tens of thousands of enterprises around the world.

More information on the Spring4Shell vulnerability can be found on WhiteSource’s blog: ​​Spring4Shell Zero-Day Vulnerability: Information and Remediation for CVE-2022-22965.

Meet The Author

Adam Murray

Adam Murray is a content writer at WhiteSource. He began his career in corporate communications and PR, in London and New York, before moving to Tel Aviv. He’s spent the last ten years working with tech companies like Amdocs, Gilat Satellite Systems, Allot Communications, and Sisense. He holds a Ph.D. in English Literature. When he’s not spending time with his wife and son, he’s preoccupied with his beloved football team, Tottenham Hotspur.

Subscribe to Our Blog