Quantum Secular Labs / Blog / Advisories
CVE-2022-22965: Spring Framework JDK 9+ Remote Code Execution Vulnerability
CVE-2022-22965 is rated critical with a CVSS v3.1 base score of 9.8 and affects VMware Spring Framework, along with 37 other products in NVD’s configuration data. Per its scoring, it can be exploited over the network, without authentication, without any user interaction. The scored impact on confidentiality, integrity and availability is the highest available. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-04-04, which means exploitation in the wild has been observed.
Vulnerability description
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
Severity breakdown
CVSS v3.1 9.8: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector: Network. Exploitable remotely over the network, with no need for local or physical access.
- Attack complexity: Low. No special conditions; the attack can be repeated reliably.
- Privileges required: None. No account or prior access is needed.
- User interaction: None. No action from any user is needed.
- Scope: Unchanged. Impact stays within the vulnerable component.
- Confidentiality impact: High. Total loss of confidentiality; sensitive data can be fully disclosed.
- Integrity impact: High. Total loss of integrity; data or system state can be fully modified.
- Availability impact: High. Total loss of availability; the component can be shut down.
Underlying weakness
CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Affected products
- VMware Spring Framework: before 5.2.20; from 5.3.0 before 5.3.18
- Cisco Cx Cloud Agent: before 2.1.0
- Oracle Communications Cloud Native Core Automated Test Suite: 1.9.0; 22.1.0
- Oracle Communications Cloud Native Core Console: 1.9.0; 22.1.0
- Oracle Communications Cloud Native Core Network Exposure Function: 22.1.0
- Oracle Communications Cloud Native Core Network Function Cloud Native Environment: 1.10.0; 22.1.0
- Oracle Communications Cloud Native Core Network Repository Function: 1.15.0; 22.1.0
- Oracle Communications Cloud Native Core Network Slice Selection Function: 1.8.0; 1.15.0; 22.1.0
- Oracle Communications Cloud Native Core Policy: 1.15.0; 22.1.0
- Oracle Communications Cloud Native Core Security Edge Protection Proxy: 1.7.0; 22.1.0
- Oracle Communications Cloud Native Core Unified Data Repository: 1.15.0; 22.1.0
- Oracle Communications Policy Management: 12.6.0.0.0
- Oracle Financial Services Analytical Applications Infrastructure: 8.1.1; 8.1.2.0
- Oracle Financial Services Behavior Detection Platform: 8.1.1.0; 8.1.1.1; 8.1.2.0
- Oracle Financial Services Enterprise Case Management: 8.1.1.0; 8.1.1.1; 8.1.2.0
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://tanzu.vmware.com/security/cve-2022-22965
- http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html
- http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.kb.cert.org/vuls/id/970766
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22965