VMware Tanzu · Spring Cloud
The flaw is in the routing functionality of VMware Tanzu's Spring Cloud Function, part of the Spring Cloud product, where routing expressions are evaluated without adequate neutralisation. An attacker who can supply a specially crafted SpEL routing expression can achieve remote code execution and access local resources, without authentication or user interaction, provided the application uses the routing feature.
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
First seen exploited 5 months after disclosure. Public exploit code (PoC-in-GitHub) was available 6 days before disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
In certain versions of Spring Cloud Function, a vulnerability allows remote code execution through a specially crafted Spring Expression Language (SpEL) routing expression. This vulnerability, known as "Spring4Shell," can be exploited by sending crafted queries to a server running the Spring Core framework. Hackers are actively exploiting this flaw to execute malicious Java code on vulnerable servers. Initial exploit attempts were observed targeting a honeypot on port 9001. The exploit modifies logging configurations to create a webshell by writing code to a log file, which is then executed via a browser. Although there is scanning activity for vulnerable hosts, the exploitation is less widespread compared to Log4Shell, as it requires specific conditions beyond just using the framework.
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: org.springframework.cloud:spring-cloud-function-context.
Upgrade to 3.2.3 or later
Set the version to 3.2.3 or later in your pom.xml or build.gradle.
The first fix for CVE-2022-22963. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| 3.2.0 up to 3.2.3 | 3.2.3 |
| All versions before 3.1.7 | 3.1.7 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.