VMware Spring Cloud Function远程代码执行漏洞

详细信息

漏洞类型

代码注入

漏洞描述

Spring Cloud是Spring社区的一款基于Spring Boot实现的微服务框架。 在Spring Cloud Function版本3.1.6、3.2.2和更旧的不支持版本中，当使用路由功能时，用户可以提供精心编制的SpEL作为路由表达式，这可能导致远程代码执行和访问本地资源。

修复建议

有关修补程序、升级或建议的解决方法信息，请参阅VMware Tanzu网站： https://tanzu.vmware.com/security/cve-2022-22963

参考链接

• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005

  OSV · Third Party Advisory

• https://tanzu.vmware.com/security/cve-2022-22963

  OSV

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-scf-rce-DQrHhJxH

  OSV

• https://tanzu.vmware.com/security/cve-2022-22963

  NVD · Vendor Advisory

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-scf-rce-DQrHhJxH

  NVD · vendor-advisory

• https://access.redhat.com/security/cve/cve-2022-22963
• https://packetstormsecurity.com/files/166562/Spring-Cloud-Function-SpEL-Injection.html
• https://www.cybersecurity-help.cz/vdb/SB2022033107
• https://cxsecurity.com/cveshow/CVE-2022-22963/
• https://www.oracle.com/security-alerts/cpujul2022.html

  OSV · Third Party Advisory · Patch

• http://packetstormsecurity.com/files/173430/Spring-Cloud-3.2.2-Remote-Command-Execution.html

  OSV · Exploit · Third Party Advisory · VDB Entry

• https://www.oracle.com/security-alerts/cpuapr2022.html

  OSV · Third Party Advisory · Patch

• https://security.paloaltonetworks.com/CVE-2022-22963
• https://nvd.nist.gov/vuln/detail/CVE-2022-22963

  OSV

• https://github.com/advisories/GHSA-6v73-fgf6-w5j7
• https://github.com/spring-cloud/spring-cloud-function

  OSV

• https://osv.dev/vulnerability/GHSA-6v73-fgf6-w5j7

  OSV

• https://osv.dev/vulnerability/CVE-2022-22963

  OSV

• https://spring.io/security/cve-2022-22963/

  Spring

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22963

  NVD · US Government Resource