Spring
The dominant web framework for Java.
Where It Sits
The small stack marks its layer. Beside it, each related technology links to its own page.
- App
- FrameworkSpring
- Web Server
- Runtime
- Containers
- OS
- Hypervisor
- Firmware
- Hardware
- Data
About
Spring is the framework most Java web applications are built with, usually in its Spring Boot form. It runs on the Java runtime and can embed a server such as Tomcat. A great deal of enterprise software sits on it.
How to Spot It
These are signs that a system runs Spring, seen from outside without signing in, such as a response header, a cookie, a path or a default port. They help you find where it runs across your own estate. A version shown to the world also tells anyone scanning which flaws might apply, so it is worth hiding.
- Path
/actuator/health- Page source
Whitelabel Error Page
If It Has a Flaw
Because so much enterprise software runs on Spring, a flaw in the framework can reach a huge number of applications at once.
Every app built with it is exposed.
Well-Known Flaws
Each flaw has a CVE id, the unique number a publicly known vulnerability is given so that every advisory names the same flaw. The id links to the advisory, and the card says what the flaw let an attacker do and how far it reached because of where Spring sits.
CVE-2022-22965 (opens in a new tab)2022
Spring4Shell
A data-binding flaw let attackers run code on apps using Spring on certain set-ups.
Reach It reached every app on such a set-up through the framework, whatever the app's own code did.
Rivals
Rivals do the same job on the same layer, so a system usually runs one of them in any one place. A flaw in a rival does not reach Spring.
Stacks and Code
Its code arrives from the sources listed, and each source's page says how bad code could get in through it.
- Its Code Comes From
Maven CentralCI and Build Systems