CRITICAL

CVE-2022-22965

Vmware Spring Framework 2022-04-01 CVSS v3.1
CVSS
9.8
KEV

Description

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

Summary dbcve.org

Remote code execution in Spring MVC or Spring WebFlux applications running on JDK 9+ via unsafe data binding, with the specific known exploit vector requiring a WAR deployment on Tomcat. Spring Boot executable jar deployments are not vulnerable to the known exploit, though the underlying data-binding issue is more general and may have other attack paths.

Mitigation

Upgrade the Spring Framework to a patched version per the Spring advisory. If upgrading is not immediately feasible, switch the deployment packaging from a WAR on Tomcat to a Spring Boot executable jar to block the known exploit vector, and restrict access to the affected application as an interim measure.

Proof of Concept
Patch Commit

Weakness (CWE)

CWE-94 Code Injection

EPSS Score

99.64%
Probability of exploitation in next 30 days
99.9th percentile

References

View on dbcve.org
Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.
Back to CVE