Sangfor NGAF customers, please update NGAF security protection.No Sangfor product or service uses the Spring Framework and thus none of our products or services are affected by this vulnerability The JDK version found in the above is 8, which is not affected by the vulnerability. If the version number is less than or equal to 8, it is not affected by the vulnerability, as shown below: Note: On the running server of the business system, run the 'java -version' command to check the running JDK version. If the introduction of this code snippet is found, add Perform a full search for the annotation in the application to see if the tDisallowedFields method is called in the method body. Users can decide whether to adopt the solution based on their business needs.ġ. This workaround does not fix the issue completely. Note: Spring Framework 5.3.18 and Spring Framework 5.2.20 are two secure versions officially provided by Spring (as of March 31) Affected users can download it from the following link: Spring Framework has released a new version to fix this vulnerability. However, if spring-beans is not found, it does not prove definitively that Spring Framework is not used. (The version of spring-beans in the image is 5.2.3, which may be affected by the vulnerability.) If the spring-beans is found, and the field inside the tag is less than 5.3.18 or 5.2.20, it may be affected by the vulnerability. If the project is compiled using Maven, there will usually be a pom.xml in the root directory of the project. Spring Framework 5.3.X tag is less than 5.3.18 or 5.2.20, it may be affected by the vulnerability.There are millions of applications on the internet that were developed using the Spring Framework. Spring Framework is a very popular Java development framework. NOTE: Palo Alto Unit 42 has reported that an exploit for this vulnerability has been seen in the wild. The exploitation of this vulnerability could result in a webshell being installed onto the compromised server that allows further command execution. However, the nature of the vulnerability is more general, and there may be other ways to exploit it. If the application is deployed as a Spring Boot executable jar, i.e., the default, it is not vulnerable to the exploit. The specific exploit requires the application to run on Tomcat as a WAR deployment. The vulnerability impacts Spring MVC and Spring WebFlux applications running on JDK 9+. Sangfor security team received a notice about a remote code execution vulnerability in the Spring Framework, named SpringShell and classified as critical. It helps developers create high performance, easily testable, and reusable code. Spring Framework is a lightweight open-source application framework for developing enterprise Java applications.

Spring framework code