Fix CVE-2022-22965: Upgrade Spring Framework to patch Spring4Shell RCE vulnerability

[Copilot]

Spring Framework versions prior to 5.3.18 contain a critical remote code execution vulnerability (CVE-2022-22965, "Spring4Shell") exploitable in Spring MVC/WebFlux applications running on JDK 9+ with Tomcat. CVSS 9.8.

Changes

• build.gradle.kts: Upgraded spring-boot-starter-web from 2.5.10 → 2.6.6
  • Transitively upgrades Spring Framework from 5.3.16 (vulnerable) → 5.3.18 (patched)

-implementation ("org.springframework.boot:spring-boot-starter-web:2.5.10")
+implementation ("org.springframework.boot:spring-boot-starter-web:2.6.6")

Notes

Code review identified unrelated Log4j 2.14.1 vulnerability (CVE-2021-44228). Should be addressed separately.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>CRITICAL: Remote Code Execution (Spring4Shell) in Spring Framework - CVE-2022-22965</issue_title>
<issue_description>## Vulnerability Details

• CVE ID: CVE-2022-22965
• Affected Entities: 1

Entities in this repository:

1. AuthenticationService

---

Remediation Plan

Summary

A critical remote code execution vulnerability (CVE-2022-22965, 'Spring4Shell') has been identified in the Spring Framework prior to versions 5.2.20 and 5.3.18. This vulnerability allows attackers to execute arbitrary code on affected systems via data binding in Spring MVC or Spring WebFlux applications running on JDK 9+ and deployed as WAR files on Apache Tomcat.

Risk Assessment

• Severity: CRITICAL (CVSS 9.8)
• Exploit Prerequisites:
  • JDK 9 or higher
  • Apache Tomcat as the Servlet container
  • Application packaged as WAR
  • Use of spring-webmvc or spring-webflux dependency
• Impact: Successful exploitation can lead to full remote code execution, potentially compromising the entire application and underlying infrastructure.

Affected Resources

The following services are confirmed to be affected:

• AuthenticationService (GUID: MTI5MjIyMzV8QVBNfEFQUExJQ0FUSU9OfDcyNDE5ODI2)
• InventoryManagementService (GUID: MTI5MjIyMzV8QVBNfEFQUExJQ0FUSU9OfDcyNDI5Mzg5)
• FuzzyService (GUID: MTI5MjIyMzV8QVBNfEFQUExJQ0FUSU9OfDcyNDMwMjky)
• UserMappingService (GUID: MTI5MjIyMzV8QVBNfEFQUExJQ0FUSU9OfDcyNDMwMjQy)
• RoutingService (GUID: MTI5MjIyMzV8QVBNfEFQUExJQ0FUSU9OfDY1OTA0NDU1)
• PaymentService (GUID: MTI5MjIyMzV8QVBNfEFQUExJQ0FUSU9OfDY1OTMyMzAw)

Your Task, @copilot

• Analyze the existing codebase for each affected service listed above.
• Identify and modify the correct, existing file(s) where the vulnerable Spring Framework dependency is declared.
• Do NOT generate new files if a relevant source file already exists.
• Modify the existing resource block(s) to upgrade the Spring Framework dependency to a patched version as described below.

---

Generated by Security Agent Workflow</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes CRITICAL: Remote Code Execution (Spring4Shell) in Spring Framework - CVE-2022-22965 #31

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.