Actively exploited · Published Apr 1, 2022 · Assigned by vmware
CVE-2022-22963
Critical 9.8 Exploited
In plain English
A critical-severity code injection in Spring Cloud Function. Attackers are actively exploiting it in the wild (listed by CISA on August 25, 2022). The chance it is exploited in the next 30 days is estimated at 99.9% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Sep 15, 2022.
Official description
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.cloud:spring-cloud-function-context | 3.2.3 | GHSA-6v73-fgf6-w5j7 |
| Maven | org.springframework.cloud:spring-cloud-function-context | 3.1.7 | GHSA-6v73-fgf6-w5j7 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Spring Cloud Function | Spring Cloud Function versions 3.1.6, 3.2.2 and all old and unsupported versions |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://tanzu.vmware.com/security/cve-2022-22963
- 20220401 Vulnerability in Spring Cloud Function Framework Affecting Cisco Products: March 2022 vendor-advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005
- https://www.oracle.com/security-alerts/cpujul2022.html
- http://packetstormsecurity.com/files/173430/Spring-Cloud-3.2.2-Remote-Command-Execution.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22963 government-resource