WAF mitigations for Spring4Shell
Mar 31, 2022Michael Tremante, Himanshu Anand
Summary
This post details the deployment of new managed mitigation rules for the Spring4Shell vulnerabilities (CVE-2022-22947, CVE-2022-22950, CVE-2022-22963, CVE-2022-22965) to protect customers using Java Spring and related software components. Specific WAF rule IDs and legacy IDs are provided for: Managed Rule 'Spring - CVE:CVE-2022-22947', Managed Rule 'PHP - Code Injection' (blocking PoCs for CVE-2022-22950 and CVE-2022-22963), Managed Rule 'Plone - Dangerous File Extension' (blocking PoCs for CVE-2022-22963 and CVE-2022-22965), and Managed Rule 'Spring - Code Injection' (deployed for additional variations of CVE-2022-22963 and CVE-2022-22965). It also recommends using the OWASP Core Ruleset with default or high sensitivity settings.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack