CVE-2022-22963
VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability
Description
CVE-2022-22963 is a remote code execution vulnerability in VMware Tanzu Spring Cloud Function that allows attackers to execute arbitrary code by providing a specially crafted Spring Expression Language (SpEL) expression as a routing expression. When the routing functionality is used, the application evaluates SpEL expressions from HTTP request headers without proper sanitization, enabling unauthenticated attackers to execute commands on the server. This vulnerability emerged during the same period as the widely publicized Spring4Shell (CVE-2022-22965), amplifying its visibility and exploitation. CISA has added CVE-2022-22963 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 94.5% (99th percentile), exploitation is near-certain.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| vmware | spring cloud function | <= 3.1.6; >= 3.2.0, <= 3.2.2 |
| oracle | banking branch | 14.5 |
| oracle | banking cash management | 14.5 |
| oracle | banking corporate lending process management | 14.5 |
| oracle | banking credit facilities process management | 14.5 |
| oracle | banking electronic data exchange for corporates | 14.5 |
| oracle | banking liquidity management | 14.2; 14.5 |
| oracle | banking origination | 14.5 |
| oracle | banking supply chain finance | 14.5 |
| oracle | banking trade finance process management | 14.5 |
| oracle | banking virtual account management | 14.5 |
| oracle | communications cloud native core automated test suite | 1.9.0; 22.1.0 |
| oracle | communications cloud native core console | 1.9.0; 22.1.0 |
| oracle | communications cloud native core network exposure function | 22.1.0 |
| oracle | communications cloud native core network function cloud native environment | 1.10.0; 22.1.0; 22.1.2 |
| oracle | communications cloud native core network repository function | 1.15.0; 22.1.0 |
| oracle | communications cloud native core network slice selection function | 1.8.0; 22.1.0 |
| oracle | communications cloud native core policy | 1.15.0; 22.1.0; 22.1.3 |
| oracle | communications cloud native core security edge protection proxy | 1.7.0; 22.1.0 |
| oracle | communications cloud native core unified data repository | 1.15.0; 22.1.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/173430/Spring-Cloud-3.2.2-Remote-Command-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005(Third Party Advisory)
- https://tanzu.vmware.com/security/cve-2022-22963(Vendor Advisory)
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-scf-rce-DQrHhJxH(Third Party Advisory)
- https://www.oracle.com/security-alerts/cpuapr2022.html(Patch, Third Party Advisory)
- https://www.oracle.com/security-alerts/cpujul2022.html(Patch, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22963(US Government Resource)
Weakness Type
CWE-94: Code Injection
CVE-2022-22963 exploits a code injection weakness in VMware Tanzu Spring Cloud Function, where Spring Expression Language (SpEL) expressions provided by external users are evaluated without adequate sanitization. The routing functionality accepts SpEL expressions from HTTP request headers and executes them in the server-side context, allowing an attacker to inject arbitrary code that is evaluated by the Spring expression evaluation engine with full access to the Java runtime environment.
Learn more: CWE-94 — Improper Control of Generation of Code
Impact Analysis
CVE-2022-22963 represents a critical threat to applications built on the Spring Cloud Function framework. The vulnerability is remotely exploitable over the network without authentication, requiring no user interaction and involving low attack complexity. By injecting malicious SpEL expressions through HTTP request headers, an attacker achieves arbitrary code execution on the application server with the privileges of the Java process. This can lead to complete server compromise, access to application data and configuration secrets, lateral movement to connected databases and services, and deployment of web shells or persistent backdoors. With an EPSS score of 94.5% (99th percentile), this vulnerability is among the most actively exploited. Its disclosure alongside Spring4Shell created a heightened threat landscape for Spring-based applications.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2022-22963 in the wild by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 15, 2022. The EPSS score of 94.5% (99th percentile) reflects near-certain exploitation activity. The exploit is trivial — a single HTTP request with a malicious SpEL expression in the spring.cloud.function.routing-expression header is sufficient to achieve code execution. Public exploit code and proof-of-concept scripts are widely available, and the vulnerability was actively scanned for within hours of its disclosure. No specific ransomware campaigns are currently associated with this CVE, but it has been widely used for cryptominer deployment and web shell installation.
Remediation
- Upgrade Spring Cloud Function immediately: Per the CISA KEV required action, apply updates per vendor instructions. Upgrade to Spring Cloud Function 3.1.7 or 3.2.3 or later, which addresses the SpEL injection vulnerability as documented in VMware Tanzu advisory.
- Block malicious routing expression headers: As an interim mitigation, configure a reverse proxy or WAF to strip or reject HTTP requests containing the spring.cloud.function.routing-expression header from external sources.
- Disable the routing functionality if not required: If your application does not use the routing functionality of Spring Cloud Function, disable it in the application configuration to eliminate the attack vector entirely.
- Scan for indicators of compromise: Review application server logs for HTTP requests containing SpEL expressions in headers, unusual process spawning from the Java process, or the presence of web shells in the application deployment directory.
- Implement runtime application security: Deploy a Runtime Application Self-Protection (RASP) solution or Java security manager policies to restrict the Java process from executing OS commands, limiting the impact of any successful exploitation.
Technical Details
CVE-2022-22963 is a Spring Expression Language (SpEL) injection vulnerability in VMware Tanzu Spring Cloud Function. Spring Cloud Function provides a routing mechanism that allows dynamic routing of function invocations based on expressions. The vulnerability exists because the routing functionality accepts SpEL expressions from the spring.cloud.function.routing-expression HTTP header and evaluates them using the Spring expression parser without adequate input sanitization or sandboxing. An attacker can craft an HTTP request with a malicious SpEL expression that invokes Java Runtime methods, such as T(java.lang.Runtime).getRuntime().exec(), to execute arbitrary operating system commands. The expression is evaluated in the full context of the Spring application, with access to all Java classes on the classpath, making the code injection vector equivalent to unrestricted remote code execution. The fix in Spring Cloud Function 3.1.7/3.2.3 restricts the SpEL evaluation context to prevent access to dangerous classes and methods.
Frequently Asked Questions
Is CVE-2022-22963 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2022-22963 by adding it to the Known Exploited Vulnerabilities catalog. The EPSS score of 94.5% (99th percentile) indicates near-certain exploitation. The exploit requires only a single HTTP request, and public PoC code is widely available. Active scanning began within hours of disclosure.
What products are affected by CVE-2022-22963?
CVE-2022-22963 affects VMware Tanzu Spring Cloud Function versions prior to 3.1.7 and 3.2.3. Applications that use the routing functionality and accept the spring.cloud.function.routing-expression header from external requests are vulnerable.
How do I fix CVE-2022-22963?
Upgrade Spring Cloud Function to version 3.1.7 or 3.2.3 or later. As an interim measure, block HTTP requests containing the spring.cloud.function.routing-expression header at the reverse proxy or WAF level. Disable the routing functionality if it is not required by your application.
How severe is CVE-2022-22963?
CVE-2022-22963 is a critical severity SpEL injection vulnerability enabling unauthenticated remote code execution. With an EPSS score of 94.5% (99th percentile), it is among the most actively exploited vulnerabilities. Exploitation requires only a single HTTP request and grants full server compromise capabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.