Coverage for multiple Spring vulnerabilities (CVE-2022-22947, CVE-2022-22950, CVE-2022-22963, CVE-2022-22965)

Technical Articles ID: KB95447
Last Modified: 2022-04-19 04:27:42 Etc/GMT

Summary

Recent updates to this article

Date	Update
April 18, 2022	Added that the latest ENS AMCore content has detection for all known samples.
April 7, 2022	Added the related Security Bulletin link.
April 4, 2022	Added CVE-2022-22947 and updated the title.
March 31, 2022	Added Network Security Platform (NSP) User-Defined Signatures (UDS) and new CVE IDs CVE-2022-22965 and CVE-2022-22950.
March 30, 2022	Initial publication.

We're actively tracking four distinct vulnerabilities in several components of Spring. Spring is a Java framework that VMware owns. There has been confusion around these Spring vulnerabilities. We can confirm that we're tracking four vulnerabilities associated with Spring, which are unique vulnerabilities.

VMware recently released the first vulnerability, CVE-2022-22963: Spring Expression Resource Access Vulnerability. This vulnerability is within the Spring Cloud component. This vulnerability is considered Medium, with a CVSS(3.0) score of 5.4. The exploit code appears to be an unauthenticated remote code execution (RCE). If confirmed, we expect the current CVSS score of 5.4 to be adjusted.
The second vulnerability, updated as CVE-2022-22965, was first seen via exploit code leaked on Twitter. From the leaked exploit code, this issue appears to be due a failed, or partially failed, patch for a bug from a decade ago (CVE-2010-1622.) It's an unauthenticated RCE in the Spring Beans component. We verified that the leaked exploit code works in reproduction.
The third vulnerability, CVE-2022-22950: Spring Expression DoS Vulnerability, is within Spring Framework and might cause a denial-of-service (DOS) condition.
The fourth vulnerability, CVE-2022-22947: Spring Cloud Gateway Code Injection, is within Spring Cloud Gateway when the Gateway Actuator endpoint is enabled, exposed, and unsecured. This issue can lead to RCE on the remote host.

It's recommended that customers patch according to the vendor's guidance.

Owing to the severity of these vulnerabilities, we've created this article to provide communication on actions that customers can take to mitigate risk in their environment.

We're actively monitoring these vulnerabilities and researching ways to use our solutions to protect against them.

We're also reviewing all our solutions for any potential impact. See SB10380 - REGISTERED - Security Bulletin - Product status for Spring vulnerabilities (CVE-2022-22947, CVE-2022-22963, CVE-2022-22965).

NOTE: The referenced content is available only to logged in ServicePortal users. To view the content, click the link and log in when prompted.

Subscribe to this article to receive updates pertaining to related coverage and countermeasures.

To receive email notification when this article is updated, click Subscribe on the right side of the page. You must be logged on to subscribe.

For further information, see the following articles:
CVE-2022-22947: Spring Cloud Gateway Code Injection Vulnerability
CVE-2022-22950: Spring Expression DoS Vulnerability
CVE-2022-22963: RCE in Spring Cloud Function by malicious Spring Expression
CVE-2022-22965: Spring Framework RCE via Data Binding on JDK 9+

Problem 1

VMware released CVE-2022-22963 on March 29, 2022. Spring Cloud component versions 3.1.6, 3.2.2 and earlier unsupported versions are impacted. When using the routing functionality, it's possible for a user to provide a specially crafted SpEL as a routing-expression that might result in access to local resources. A patch is available from VMware for this issue and upgrades the Spring Cloud component to version 3.1.7 or 3.2.3.

Problem 2

VMware released CVE-2022-22965 on March 31, 2022. Spring Framework versions 5.3.0–5.3.17, 5.2.0–5.2.19, and earlier unsupported versions are impacted. A Spring MVC or Spring WebFlux application running on JDK 9+ might be vulnerable to RCE via data binding. Users of affected versions should update as per the following: 5.3.x users should upgrade to 5.3.18 or later and 5.2.x users should upgrade to 5.2.20 or later.

Problem 3

VMware released CVE-2022-22950 on March 28, 2022. Spring Framework versions 5.3.0–5.3.16, and earlier unsupported versions are impacted. This issue might cause a DOS condition if a specially crafted SpEL expression is provided. Spring Framework versions 5.3.17 and later include fixes for this vulnerability.

Problem 4

VMware released CVE-2022-22947 on March 1, 2022. Spring Cloud Gateway versions 3.1.0, 3.0.0–3.0.6, and earlier unsupported versions are impacted. When the Gateway Actuator endpoint is enabled, exposed, and unsecured, it's possible for a remote attacker to provide a maliciously crafted request that can lead to arbitrary RCE on the remote hosts. Spring Cloud Gateway versions 3.1.1 and later, and 3.0.7 and later include fixes for this vulnerability.

Solution

Subscribe to this article to receive updates pertaining to related coverage and countermeasures.

To receive email notification when this article is updated, click Subscribe on the right side of the page. You must be logged on to subscribe.

Network Security Platform (NSP) User-Defined Signature: UDSs are provided as an immediate solution to known vulnerabilities.
For more information about this UDS, see REGISTERED - NSP Emergency UDS Release Notes - UDS for Multiple Vulnerabilities.

NOTE: The referenced content is available only to logged in ServicePortal users. To view the content, click the link and log in when prompted.

UDS: REGISTERED - NSP Emergency UDS Release Notes - UDS for Multiple Vulnerabilities
Attack ID: 0x452a6900
CVE Number: CVE-2022-22963
VIL/Other URL: CVE-2022-22963: RCE in Spring Cloud Function by malicious Spring Expression
Attack Protocol: HTTP
Attack Direction: Client to Server
To be included in the next regular sigset? Yes
Released date: March 31, 2022
Description: This alert indicates an attempt to exploit an RCE vulnerability in Spring Cloud Function.

UDS: REGISTERED - NSP Emergency UDS Release Notes - UDS for Multiple Vulnerabilities
Attack ID: 0x452a6a00
CVE Number: CVE-2022-22965
VIL/Other URL: CVE-2022-22965: Spring Framework RCE via Data Binding on JDK 9+
Attack Protocol: HTTP
Attack Direction: Client to Server
To be included in the next regular sigset? Yes
Released date: March 31, 2022
Description: This alert indicates an attempt to exploit an RCE vulnerability in Spring Core.

ENS AMCore Coverage: The latest AMCore content has detection for all known samples.

Affected Products

Vulnerability Response

Languages:

This article is available in the following languages:

Knowledge Center

Coverage for multiple Spring vulnerabilities (CVE-2022-22947, CVE-2022-22950, CVE-2022-22963, CVE-2022-22965)

Summary

Problem 1

Problem 2

Problem 3

Problem 4

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

Coverage for multiple Spring vulnerabilities (CVE-2022-22947, CVE-2022-22950, CVE-2022-22963, CVE-2022-22965)

Summary

Problem 1

Problem 2

Problem 3

Problem 4

Solution

Affected Products

Languages:

Choose your region

Title

Title