Spring4Shell: WAF Rules Now Blocking Known Exploits

A cluster of vulnerabilities in the Java Spring Framework and related components — collectively referred to as Spring4Shell — has prompted emergency rule deployments across Cloudflare's managed WAF. Four CVEs are currently documented, with the most severe allowing full remote code execution (RCE):

  • CVE-2022-22947 — impacts Spring Cloud Gateway
  • CVE-2022-22950 — affects Spring Framework
  • CVE-2022-22963 — affects Spring Cloud Function
  • CVE-2022-22965 — affects Spring Framework (the main Spring4Shell RCE)

Organizations running Java Spring or related components such as Spring Cloud Gateway should patch to the latest versions immediately per official Spring guidance. Cloudflare's WAF team has also published managed rules that block currently known exploit payloads; customers should verify these rules are enabled while remediation is underway.

CVE-2022-22947: Spring Cloud Gateway

A dedicated managed rule now blocks attempts against this CVE. It was released via emergency update on March 29 and has been blocking traffic since the April 4 emergency release:

Managed Rule: Spring - CVE:CVE-2022-22947

  • WAF rule ID: e777f95584ba429796856007fbe6c869
  • Legacy rule ID: 100522

Known proof-of-concept payloads for CVE-2022-22950 and CVE-2022-22963 are blocked by an existing PHP code injection rule:

Managed Rule: PHP - Code Injection

  • WAF rule ID: 55b100786189495c93744db0e1efdffb
  • Legacy rule ID: PHP100011

Payloads associated with CVE-2022-22963 and CVE-2022-22965 are intercepted by a long-standing file extension rule from the Plone ruleset:

Managed Rule: Plone - Dangerous File Extension

  • WAF rule ID: aa3411d5505b4895b547d68950a28587
  • Legacy WAF ID: PLONE0001

A new rule specifically targeting additional exploit variations for CVE-2022-22963 and CVE-2022-22965 was pushed via an emergency release on March 31, with blocking active since the April 4 emergency release:

Managed Rule: Spring - Code Injection

  • WAF rule ID: d58ebf5351d843d3a39a4480f2cc4e84
  • Legacy WAF ID: 100524

Additional Mitigation Options

Beyond the dedicated rules, the Cloudflare OWASP Core Ruleset provides another layer of defense against this CVE when deployed with default or stricter settings. Users on the legacy WAF should set OWASP sensitivity to a high level for equivalent protection.