Spring is exposed to allow remote code execution.

Security company Aspect Security today revealed that a major Security vulnerability was found in the development code of the Spring framework.

Jeff Williams, CEO of Aspect Security, said the vulnerability exists in Spring's "Expression Language" function and allows attackers to inject code.

Currently, Aspect Security has been integrated with the Spring open-source community to solve this problem. However, no patches have been released so far. Therefore, applications using the Spring framework may have security risks. We recommend that you disable the expression language function.

Williams said that the expression language feature may not be enabled by default in future Spring versions. However, if attackers exploit this vulnerability, it may pose a major threat to applications. This is very dangerous. Attackers can take over a Web application and run their code on the server. He also pointed out that the vulnerability had no connection with the recently disclosed browser Java Vulnerability.

According to the Sonatype data of the central repository that provides open-source components, more than 22 thousand organizations have downloaded more than 1.3 million Spring frameworks with security vulnerabilities.