CVE-2022-22980 SpEL Injection in Spring Data MongoDB
Attackers can execute arbitrary code via SpEL injection in Spring Data MongoDB query methods if input is not sanitized.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-22980?
CVE-2022-22980 is a critical code injection vulnerability in Spring Data MongoDB, published on 22 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.
Weakness: CWE-917
Which versions are affected by CVE-2022-22980?
4 open source packages ship an affected version, including org.springframework.data:spring-data-mongodb. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.data:spring-data-mongodb Maven | All versions | 3.3.5 |
org.springframework.data:spring-data-mongodb Maven | All versions | 3.3.5 |
org.springframework.data:spring-data-mongodb Maven | From 3.4.0 | 3.4.1 |
org.springframework.data:spring-data-mongodb Maven | From 3.4.0 | 3.4.1 |
Products include Vmware Spring Data Mongodb.
How do I fix CVE-2022-22980?
Upgrade org.springframework.data:spring-data-mongodb to a fixed version for your release line: 3.3.5 or 3.4.1.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-22980 being exploited?
There is no known exploitation of CVE-2022-22980 in the wild and no public exploit code.
Public exploit code: 7 proofs of concept on GitHub.
Other vulnerabilities in Spring Data MongoDB
Sources
Also known as GHSA-w24x-87mr-4r23.