More than that, while the vulnerability had specific requirements to be exploited, even sample code from spring.io was vulnerable: Can confirm! The #Spring4Shell ...

spring.datasource.url= jdbc:postgresql://localhost:5432/testdb spring.datasource.username= postgres spring.datasource.password= 123 spring.jpa.properties.hibernate ...

This example leverages the information found in the OidcUser object that is automatically injected after authenticating using OpenId Connect. It uses JPA to add user activity information to a MySQL ...