NetSight
IP …
critical9.8Known exploitedPublic exploit code

CVE-2022-22963

Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-08-25. Federal due date: 2022-09-15.

Apply updates per vendor instructions.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.springframework.cloud:spring-cloud-function-context>= 3.2.0, < 3.2.33.2.3

Affected products

VendorProductAffected versions
VmwareSpring Cloud Function
through 3.1.6
from 3.2.0 through 3.2.2
OracleBanking Branch
Version 14.5
OracleBanking Cash Management
Version 14.5
OracleBanking Corporate Lending Process Management
Version 14.5
OracleBanking Credit Facilities Process Management
Version 14.5
OracleBanking Electronic Data Exchange For Corporates
Version 14.5
OracleBanking Liquidity Management
Versions 14.2, 14.5
OracleBanking Origination
Version 14.5
OracleBanking Supply Chain Finance
Version 14.5
OracleBanking Trade Finance Process Management
Version 14.5
OracleBanking Virtual Account Management
Version 14.5
OracleCommunications Cloud Native Core Automated Test Suite
Versions 1.9.0, 22.1.0

Weakness classification

CWE-94CWE-917

References