---
title: "Spring4Shell Configuration"
description: "Set scan policy to run Spring4Shell rule"
url: https://docs.stackhawk.com/hawkscan/configuration/spring4shell-configuration/
---

# Spring4Shell Configuration

The [Spring4Shell](https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement#vulnerability) vulnerability is a Remote Code Execution vulnerability that was recently discovered in the Spring framework. HawkScan version `2.3.0` and later includes a rule to scan for this vulnerability in Spring applications, but it is not enabled by default.

In order to activate the Spring4Shell rule, update your `stackhawk.yml` scan config to include the corresponding policy name in the `hawk.scan.policyName` property:

| Policy Name | Result |
| - | - |
| `DEFAULT_SPRING4SHELL` | Runs a scan with all the default rules enabled, with Spring4Shell included. |
| `SPRING4SHELL_ONLY` | Runs a scan with ONLY the Spring4Shell rule enabled. All other rules will not be run by the scanner. |

For example:

```yaml
hawk:
  scan:
    policyName: DEFAULT_SPRING4SHELL
```