Spring4Shell and CVE-2022-22963: Affected Versions, Exploitation Conditions and Fixes
Summary
The article details affected Spring Framework and Spring Cloud Function versions, exploitation requirements, available updates and workarounds, and Wiz’s findings on CVE-2022-22965 prevalence in cloud environments.
Key points
- CVE-2022-22965 affects Spring Framework versions earlier than 5.2.19 and 5.3.0–5.3.17; the article recommends updating to 5.2.20 or 5.3.18, or applying Spring’s workarounds.
- CVE-2022-22963 affects Spring Cloud Function versions earlier than 3.1.6 and 3.2.0–3.2.2; the article recommends updating to 3.1.7 or 3.2.3.
- Both vulnerabilities can allow remote code execution through specially crafted HTTP POST requests, but exploitation requires an exposed application with an open HTTP port.
- The article says known Spring4Shell exploitation also required JDK 9 or higher, particular Spring dependencies and data-binding parameters, and, for known methods, WAR packaging with specified web containers. It notes these prerequisites could change as new exploits emerge.
- CVE-2022-22963 requires routing functionality, and the article reports that proof-of-concept exploits were available; it expects practical impact to be limited partly because the library was uncommon in cloud environments and often used on short-lived serverless resources.
- Wiz reported that about 63% of cloud environments it examined were affected by CVE-2022-22965; among affected resources, about 75% were virtual machines and 25% containers. The article cautions that many were not exploitable by then-known methods.
Article Details
- Vulnerability Types
- Remote code execution via data binding
- Remote code execution via a malicious SpEL expression
- Severity
- Critical
- Affected Versions
- Spring Framework versions earlier than 5.2.19
- Spring Framework versions 5.3.0 to 5.3.17
- Spring Cloud Function versions earlier than 3.1.6
- Spring Cloud Function versions 3.2.0 to 3.2.2
- Exploitation Status
- unknown
- Exploit Availability
- public_poc
- Patch Status
- available
CVE
CVE-2010-1622Praetorian have claimed that this vulnerability is in fact a bypass of a much older vulnerability in Spring Framework (CVE-2010-1622).CVE-2022-22963CVE-2022-22963 (Spring Cloud Function RCE via malicious SpEL Expression) –CVE-2022-22965Updated April 13th, 2022 to include the latest available information about CVE-2022-22965, further explanation of dependencies in Spring Framework, and data about the prevalence of this vulnerability in cloud
Vendors
PraetorianPraetorian have claimed that this vulnerability is in fact a bypass of a much older vulnerability in Spring Framework (CVE-2010-1622).VMwareInitially rated as medium severity, VMware have since changed their assessment and rated this vulnerability as critical.WizProtecting your cloud environment with Wiz
Products
Apache TomcatWeb applications must be served by Apache Tomcat, GlassFish or Payara (as a web container)GlassFishWeb applications must be served by Apache Tomcat, GlassFish or Payara (as a web container)PayaraWeb applications must be served by Apache Tomcat, GlassFish or Payara (as a web container)Spring Cloud FunctionCVE-2022-22963 (Spring Cloud Function RCE via malicious SpEL Expression) –Spring Frameworkthe latest available information about CVE-2022-22965, further explanation of dependencies in Spring Framework, and data about the prevalence of this vulnerability in cloud environments.Wiz Threat CenterWiz identifies all vulnerable assets and their effective exposure statusThe Wiz Threat Center is the best place to view any critical security issues affecting your environment.