CVE-2022-22963 in VMware and Oracle Products
Published on April 1, 2022

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

Vendor Advisory NVD

Known Exploited Vulnerability

This VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. When using routing functionality in VMware Tanzu's Spring Cloud Function, it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

The following remediation steps are recommended / required by September 15, 2022: Apply updates per vendor instructions.

Vulnerability Analysis

CVE-2022-22963 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.

What is an EL Injection Vulnerability?

The software constructs all or part of an expression language (EL) statement in a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

CVE-2022-22963 has been classified to as an EL Injection vulnerability or weakness.

Products Associated with CVE-2022-22963

You can be notified by stack.watch whenever vulnerabilities like CVE-2022-22963 are published in these products:

VMware Spring Cloud Function

Oracle Sd Wan Edge

Oracle Retail Xstore Point Of Service

Oracle Communications Cloud Native Core Security Edge Protection Proxy

Oracle Banking Cash Management

Oracle Banking Trade Finance Process Management

Oracle Banking Credit Facilities Process Management

Oracle Banking Corporate Lending Process Management

Oracle Banking Supply Chain Finance

Oracle Communications Cloud Native Core Console

Oracle Communications Cloud Native Core Network Slice Selection Function

Oracle Communications Cloud Native Core Policy

Oracle Communications Cloud Native Core Unified Data Repository

Oracle Communications Communications Policy Management

Oracle Financial Services Behavior Detection Platform

Oracle Financial Services Enterprise Case Management

Oracle Mysql Enterprise Monitor

Oracle Banking Liquidity Management

Oracle Banking Virtual Account Management

Oracle Communications Cloud Native Core Automated Test Suite

Oracle Communications Cloud Native Core Network Exposure Function

Oracle Communications Cloud Native Core Network Function Cloud Native Environment

Oracle Communications Cloud Native Core Network Repository Function

Oracle Financial Services Analytical Applications Infrastructure

Oracle Product Lifecycle Analytics

Oracle Banking Origination

Oracle Banking Electronic Data Exchange Corporates

Oracle Banking Branch

What versions are vulnerable to CVE-2022-22963?

VMware Spring Cloud Function Version 3.2.0 through 3.2.2
VMware Spring Cloud Function Up to Version 3.1.6