{"id":"CVE-2022-22963","published":"2022-04-01T23:15:13Z","modified":"2026-06-17T04:29:15Z","title":"VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability","vendor":"VMware Tanzu","product":"Spring Cloud","tier":"core","eol":null,"description":{"text":"In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is in the routing functionality of VMware Tanzu's Spring Cloud Function, part of the Spring Cloud product, where routing expressions are evaluated without adequate neutralisation. An attacker who can supply a specially crafted SpEL routing expression can achieve remote code execution and access local resources, without authentication or user interaction, provided the application uses the routing feature.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:44:43Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99938,"percentile":0.99971,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2022-08-25","dueDate":"2022-09-15","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://tanzu.vmware.com/security/cve-2022-22963;  https://nvd.nist.gov/vuln/detail/CVE-2022-22963","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-08-19","exploitedFirstSeen":"2022-08-19","ransomware":false,"evidence":[{"url":"https://unit42.paloaltonetworks.com/recent-exploits-network-security-trends/","date":"2022-08-19"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-08-25"},{"url":"https://web-assets.esetstatic.com/wls/2023/07/eset_threat_report_h12023.pdf","date":"2023-07-11"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa23-215a","date":"2023-08-03"},{"url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/11/09055246/Modern-Asian-APT-groups-TTPs_report_eng.pdf","date":"2023-11-09"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-18&host_type=src&vulnerability=cve-2022-22963","date":"2023-11-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-19&host_type=src&vulnerability=cve-2022-22963","date":"2023-11-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-24&host_type=src&vulnerability=cve-2022-22963","date":"2023-11-24"},{"url":"https://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-threat-report-h22023.pdf","date":"2023-12-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-20&host_type=src&vulnerability=cve-2022-22963","date":"2023-12-20"}],"evidenceTotal":123,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-917","name":"Improper Neutralization of Special Elements used in an Expression Language Statement"},{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"http://packetstormsecurity.com/files/173430/Spring-Cloud-3.2.2-Remote-Command-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005","tags":["Third Party Advisory"]},{"url":"https://tanzu.vmware.com/security/cve-2022-22963","tags":["Vendor Advisory"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-scf-rce-DQrHhJxH","tags":["Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["Patch","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["Patch","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/173430/Spring-Cloud-3.2.2-Remote-Command-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005","tags":["Third Party Advisory"]},{"url":"https://tanzu.vmware.com/security/cve-2022-22963","tags":["Vendor Advisory"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-scf-rce-DQrHhJxH","tags":["Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["Patch","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["Patch","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22963","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"exploitation_technique","evidence":[],"comment":"In certain versions of Spring Cloud Function, a vulnerability allows remote code execution through a specially crafted Spring Expression Language (SpEL) routing expression. This vulnerability, known as \"Spring4Shell,\" can be exploited by sending crafted queries to a server running the Spring Core framework. Hackers are actively exploiting this flaw to execute malicious Java code on vulnerable servers. Initial exploit attempts were observed targeting a honeypot on port 9001. The exploit modifies logging configurations to create a webshell by writing code to a log file, which is then executed via a browser. Although there is scanning activity for vulnerable hosts, the exploitation is less widespread compared to Log4Shell, as it requires specific conditions beyond just using the framework.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1059.007","name":"JavaScript","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"primary_impact","evidence":[],"comment":"In certain versions of Spring Cloud Function, a vulnerability allows remote code execution through a specially crafted Spring Expression Language (SpEL) routing expression. This vulnerability, known as \"Spring4Shell,\" can be exploited by sending crafted queries to a server running the Spring Core framework. Hackers are actively exploiting this flaw to execute malicious Java code on vulnerable servers. Initial exploit attempts were observed targeting a honeypot on port 9001. The exploit modifies logging configurations to create a webshell by writing code to a log file, which is then executed via a browser. Although there is scanning activity for vulnerable hosts, the exploitation is less widespread compared to Log4Shell, as it requires specific conditions beyond just using the framework.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1505.003","name":"Web Shell","tactics":["persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"secondary_impact","evidence":[],"comment":"In certain versions of Spring Cloud Function, a vulnerability allows remote code execution through a specially crafted Spring Expression Language (SpEL) routing expression. This vulnerability, known as \"Spring4Shell,\" can be exploited by sending crafted queries to a server running the Spring Core framework. Hackers are actively exploiting this flaw to execute malicious Java code on vulnerable servers. Initial exploit attempts were observed targeting a honeypot on port 9001. The exploit modifies logging configurations to create a webshell by writing code to a log file, which is then executed via a browser. Although there is scanning activity for vulnerable hosts, the exploitation is less widespread compared to Log4Shell, as it requires specific conditions beyond just using the framework.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"}],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-function-context","vulnerableRanges":[">=3.2.0, <3.2.3","<3.1.7"],"patched":["3.2.3","3.1.7"],"from":["GHSA-6v73-fgf6-w5j7"],"provenance":"source"}],"advisories":[{"id":"GHSA-6v73-fgf6-w5j7","url":"https://github.com/advisories/GHSA-6v73-fgf6-w5j7","severity":"CRITICAL","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-function-context","vulnerableRanges":[">=3.2.0, <3.2.3"],"patched":["3.2.3"],"provenance":"source","from":"GHSA"},{"id":"GHSA-6v73-fgf6-w5j7","url":"https://github.com/advisories/GHSA-6v73-fgf6-w5j7","severity":"CRITICAL","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-function-context","vulnerableRanges":["<3.1.7"],"patched":["3.1.7"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-1654","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-1654","exploited":true,"exploitedSince":"2022-08-25","provenance":"source"},"exploits":[{"id":51577,"url":"https://www.exploit-db.com/exploits/51577","title":"Spring Cloud 3.2.2 - Remote Command Execution (RCE)","type":"webapps","platform":"java","date":"2023-07-11","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2023-07-11"},"pocGithub":{"count":27,"skipped":3,"earliest":"2022-03-26","earliestUrl":"https://github.com/hktalent/spring-spel-0day-poc","repos":[{"name":"hktalent/spring-spel-0day-poc","url":"https://github.com/hktalent/spring-spel-0day-poc","stars":354,"created":"2022-03-26"},{"name":"dinosn/CVE-2022-22963","url":"https://github.com/dinosn/CVE-2022-22963","stars":118,"created":"2022-03-30"},{"name":"darryk10/CVE-2022-22963","url":"https://github.com/darryk10/CVE-2022-22963","stars":34,"created":"2022-03-30"},{"name":"J0ey17/CVE-2022-22963_Reverse-Shell-Exploit","url":"https://github.com/J0ey17/CVE-2022-22963_Reverse-Shell-Exploit","stars":24,"created":"2023-03-18"},{"name":"me2nuk/CVE-2022-22963","url":"https://github.com/me2nuk/CVE-2022-22963","stars":19,"created":"2022-03-31"}]},"metasploit":[{"name":"Spring Cloud Function SpEL Injection","module":"exploit/multi/http/spring_cloud_function_spel_injection","type":"exploit","disclosureDate":"2022-03-29","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/spring_cloud_function_spel_injection.rb"}],"nuclei":[{"id":"CVE-2022-22963","name":"Spring Cloud - Remote Code Execution","severity":"critical","path":"http/cves/2022/CVE-2022-22963.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22963.yaml"}],"first":{"date":"2022-03-26","source":"PoC-in-GitHub","url":"https://github.com/hktalent/spring-spel-0day-poc"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/173430/Spring-Cloud-3.2.2-Remote-Command-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1059.007"],"provenance":"source"},{"stage":"secondary","techniques":["T1505.003"],"provenance":"source"}],"timeline":[{"date":"2022-03-26","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2022-03-29, Exploit-DB 2023-07-11","url":"https://github.com/hktalent/spring-spel-0day-poc","provenance":"source"},{"date":"2022-04-01","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22963","provenance":"source"},{"date":"2022-08-19","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://unit42.paloaltonetworks.com/recent-exploits-network-security-trends/","provenance":"source"},{"date":"2022-08-25","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-08-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-1654","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":146},"priority":{"score":69.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1532 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9997"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 27 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}