CVE-2022-22963 VMware Tanzu Spring Cloud Function Remote Code Execution
Attackers can achieve remote code execution by injecting malicious SpEL expressions into routing functionality in Spring Cloud Function.
- Exploited in the wild
- Since 25 Aug 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-22963?
CVE-2022-22963 is a critical code injection vulnerability in Oracle Communications Cloud Native Core Automated Test Suite, published on 1 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
Which versions are affected by CVE-2022-22963?
4 open source packages ship an affected version, including org.springframework.cloud:spring-cloud-function-context. It affects 28 products.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.cloud:spring-cloud-function-context Maven | All versions | 3.1.7 |
org.springframework.cloud:spring-cloud-function-context Maven | All versions | 3.1.7 |
org.springframework.cloud:spring-cloud-function-context Maven | From 3.2.0 | 3.2.3 |
org.springframework.cloud:spring-cloud-function-context Maven | From 3.2.0 | 3.2.3 |
Linux distribution packages (1)
openshift-serverless-clients Red Hat:serverless:1.0::el8 | All versions | 0:1.0.1-2.el8 |
Products include Oracle Banking Branch, Oracle Banking Cash Management, Oracle Banking Corporate Lending Process Management, Oracle Banking Credit Facilities Process Management, Oracle Banking Electronic Data Exchange for Corporates, Oracle Banking Liquidity Management and 22 more.
How do I fix CVE-2022-22963?
Upgrade org.springframework.cloud:spring-cloud-function-context to a fixed version for your release line: 3.1.7 or 3.2.3. US federal agencies must fix it by 15 Sep 2022.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-22963 being exploited?
Yes. Attackers have exploited CVE-2022-22963 in the wild since at least 25 Aug 2022.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 30 proofs of concept on GitHub.
Sources
Also known as GHSA-6v73-fgf6-w5j7, RHSA-2022:1291.