VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-08-25
• EPSS: 100% chance of exploitation in the next 30 days (higher than 100% of CVEs)
• Critical severity: CVSS 9.8

[ Description ]Official description

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

CISA: When using routing functionality in VMware Tanzu's Spring Cloud Function, it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 15 Sep 2022): Apply updates per vendor instructions.

• Patch on oracle.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
• Patch on oracle.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

• packetstormsecurity.com/files/173430/Spring-Cloud-3.2.2-Remote-Command-Execution.htmlExploitThird Party AdvisoryVDB Entry
• psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005Third Party Advisory
• tanzu.vmware.com/security/cve-2022-22963Vendor Advisory
• tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-scf-…Third Party Advisory
• www.oracle.com/security-alerts/cpuapr2022.htmlPatchThird Party Advisory
• www.oracle.com/security-alerts/cpujul2022.htmlPatchThird Party Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource