Spring has published new security fixes for Spring Framework “Spring4Shell” and Spring Cloud Function vulnerabilities.
A remote attacker could exploit some of these vulnerabilities to take control of unpatched systems.
CVE-2022-22965: Spring4Shell
According to VMware, the Spring Framework RCE via Data Binding on JDK 9+ vulnerability (CVE-2022-22965) also known as “Spring4Shell”, bypasses the patch for CVE-2010-1622, causing the older vulnerability to become exploitable again.
“A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it,” VMware Tanzu wrote in an advisory.
In addition, Spring published an early announcement regarding the issue via a blog post on March 31, 2022.
The issue is rated Critical severity and is fixed in Spring Framework versions 5.3.18 and 5.2.20.
CVE-2022-22963: Spring Cloud Function RCE
Moreover, Spring fixed a remote code execution (RCE) in Spring Cloud Function by malicious Spring Expression vulnerability CVE-2022-22963.
“In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources,” VMware Tanzu noted in the post.
This Critical vulnerability is addressed in Spring Cloud Function 3.1.7 and 3.2.3 versions.