CRITICAL

CVE-2022-22963

Vmware Spring Cloud Function 2022-04-01 CVSS v3.1
CVSS
9.8
KEV

Description

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

Summary dbcve.org

A remote code execution vulnerability exists in Spring Cloud Function versions 3.1.6, 3.2.2 and older when the routing functionality is enabled. An attacker can supply a specially crafted Spring Expression Language (SpEL) string as a routing-expression, which the framework evaluates unsafely, leading to arbitrary code execution and access to local resources. The vulnerability is exposed via the function routing feature and requires no authentication in typical deployments.

Mitigation

Upgrade Spring Cloud Function to a patched version (3.1.7 or 3.2.3 or later) as recommended by the vendor. As an interim measure, disable or restrict access to the function routing feature and ensure that routing-expression inputs are not attacker-controlled.

Proof of Concept
Patch Commit

Weakness (CWE)

CWE-94 Code Injection
CWE-917

EPSS Score

99.94%
Probability of exploitation in next 30 days
100th percentile

References

View on dbcve.org
Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.
Back to CVE