Help Center/ Web Application Firewall/ Best Practices/ Mitigating Web Security Vulnerabilities/ Java Spring Framework Remote Code Execution Vulnerability
Updated on 2025-04-25 GMT+08:00
View PDF
Share

Java Spring Framework Remote Code Execution Vulnerability

Spring Framework is a lightweight open-source application framework for developing enterprise Java applications. A remote code execution (RCE) vulnerability was disclosed in the Spring framework and classified as critical. This vulnerability can be exploited to attack Java applications running on JDK 9 or later versions.

Vulnerability Name

Zero-Day RCE Vulnerability in the Spring Framework

Affected Versions

  • JDK 9 or later
  • Applications developed using the Spring Framework or derived framework

Mitigation

  1. Buy a WAF instance .
  2. Add the website domain name to WAF and connect it to WAF. For details, see Adding a Domain Name to WAF.
  3. In the Basic Web Protection configuration area, set the protective action to Block and complete the configuration. For details, see Configuring Basic Web Protection Rules.

    Figure 1 Basic Web Protection

    There are two types of malicious payload in this vulnerability. Whether to enable Header Inspection depends on the type of payloads in your services.

    • Type 1: Malicious payloads are included in submitted parameters. In this situation, Header Inspection can be disabled.
    • Type 2: Malicious payloads are included in a custom header field. In this situation, Header Inspection must be enabled to block attacks.

    Type 2 malicious payloads depend on Type 1 malicious payloads so whether to enable Header Inspection is determined by your service requirements.