Spring4Shell and Spring Cloud Function Flaws Enable Remote Code Execution
Vulnerability Disclosure · 4 sources · Updated 2mo ago · First seen Sep 6, 2022
Two critical vulnerabilities in the Spring ecosystem exposed Java applications to remote code execution: CVE-2022-22965 in the Spring Framework, widely known as Spring4Shell, and CVE-2022-22963 in Spring Cloud Function. Spring4Shell abuses the framework’s data-binding mechanism under specific conditions—including JDK 9+, Apache Tomcat, vulnerable Spring Framework versions, and WAR deployment—to let attackers overwrite Tomcat logging configuration and drop a JSP web shell on the server.
The Spring Cloud Function issue, CVE-2022-22963, allows code injection through a crafted spring.cloud.function.routing-expression HTTP header that exploits Spring Expression Language (SpEL) to achieve remote code execution. Vendor and security reporting identified affected versions, published fixes and mitigations, and highlighted detection opportunities including exploit-related file hashes and generic security verdicts for spotting attempted compromise.
