CVE-2022-22963

Q: What is the severity of CVE-2022-22963?

CVE-2022-22963 has a CVSS score of 9.8 (CRITICAL). This vulnerability allows remote attackers to execute arbitrary code on systems running vulnerable versions of Spring Cloud Function. Attackers can craft malicious SpEL expressions in routing functionality to achieve remote code execution and access local resources. Organizations using Spring Cloud Function 3.1.6, 3.2.2, or older unsupported versions are affected.

9.8 CRITICAL

Remote Code Execution

📋 TL;DR

This vulnerability allows remote attackers to execute arbitrary code on systems running vulnerable versions of Spring Cloud Function. Attackers can craft malicious SpEL expressions in routing functionality to achieve remote code execution and access local resources. Organizations using Spring Cloud Function 3.1.6, 3.2.2, or older unsupported versions are affected.

💻 Affected Systems

Products:

Spring Cloud Function

Versions: 3.1.6, 3.2.2, and older unsupported versions

Operating Systems: All platforms running Java

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects deployments using routing functionality with routing expressions. The vulnerability is in the core framework, not dependent on specific configurations.

📦 What is this software?

Communications Cloud Native Core Network Function Cloud Native Environment by Oracle

View all CVEs affecting Communications Cloud Native Core Network Function Cloud Native Environment →

Communications Cloud Native Core Network Function Cloud Native Environment by Oracle

View all CVEs affecting Communications Cloud Native Core Network Function Cloud Native Environment →

Communications Cloud Native Core Network Function Cloud Native Environment by Oracle

View all CVEs affecting Communications Cloud Native Core Network Function Cloud Native Environment →

Communications Cloud Native Core Network Repository Function by Oracle

View all CVEs affecting Communications Cloud Native Core Network Repository Function →

Communications Cloud Native Core Network Repository Function by Oracle

View all CVEs affecting Communications Cloud Native Core Network Repository Function →

Communications Cloud Native Core Network Slice Selection Function by Oracle

View all CVEs affecting Communications Cloud Native Core Network Slice Selection Function →

Communications Cloud Native Core Network Slice Selection Function by Oracle

View all CVEs affecting Communications Cloud Native Core Network Slice Selection Function →

Communications Cloud Native Core Policy by Oracle

View all CVEs affecting Communications Cloud Native Core Policy →

Communications Cloud Native Core Policy by Oracle

View all CVEs affecting Communications Cloud Native Core Policy →

Communications Cloud Native Core Policy by Oracle

View all CVEs affecting Communications Cloud Native Core Policy →

Communications Cloud Native Core Security Edge Protection Proxy by Oracle

View all CVEs affecting Communications Cloud Native Core Security Edge Protection Proxy →

Communications Cloud Native Core Security Edge Protection Proxy by Oracle

View all CVEs affecting Communications Cloud Native Core Security Edge Protection Proxy →

Communications Cloud Native Core Unified Data Repository by Oracle

View all CVEs affecting Communications Cloud Native Core Unified Data Repository →

Communications Cloud Native Core Unified Data Repository by Oracle

View all CVEs affecting Communications Cloud Native Core Unified Data Repository →

Communications Communications Policy Management by Oracle

View all CVEs affecting Communications Communications Policy Management →

Financial Services Analytical Applications Infrastructure by Oracle

View all CVEs affecting Financial Services Analytical Applications Infrastructure →

Financial Services Analytical Applications Infrastructure by Oracle

View all CVEs affecting Financial Services Analytical Applications Infrastructure →

Financial Services Behavior Detection Platform by Oracle

View all CVEs affecting Financial Services Behavior Detection Platform →

Financial Services Behavior Detection Platform by Oracle

View all CVEs affecting Financial Services Behavior Detection Platform →

Financial Services Behavior Detection Platform by Oracle

View all CVEs affecting Financial Services Behavior Detection Platform →

Financial Services Enterprise Case Management by Oracle

View all CVEs affecting Financial Services Enterprise Case Management →

Financial Services Enterprise Case Management by Oracle

View all CVEs affecting Financial Services Enterprise Case Management →

Financial Services Enterprise Case Management by Oracle

View all CVEs affecting Financial Services Enterprise Case Management →

Mysql Enterprise Monitor by Oracle

View all CVEs affecting Mysql Enterprise Monitor →

Product Lifecycle Analytics by Oracle

View all CVEs affecting Product Lifecycle Analytics →

Retail Xstore Point Of Service by Oracle

View all CVEs affecting Retail Xstore Point Of Service →

Retail Xstore Point Of Service by Oracle

View all CVEs affecting Retail Xstore Point Of Service →

Sd Wan Edge by Oracle

View all CVEs affecting Sd Wan Edge →

Sd Wan Edge by Oracle

View all CVEs affecting Sd Wan Edge →

Spring Cloud Function by Vmware

View all CVEs affecting Spring Cloud Function →

Spring Cloud Function by Vmware

View all CVEs affecting Spring Cloud Function →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise allowing attackers to execute arbitrary commands, access sensitive data, install malware, and pivot to other systems in the network.

🟠

Likely Case

Remote code execution leading to data theft, service disruption, and potential lateral movement within the network.

🟢

If Mitigated

Limited impact if proper network segmentation, least privilege, and monitoring are in place, though exploitation could still cause service disruption.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Multiple public proof-of-concept exploits exist, and the vulnerability is actively exploited in the wild. No authentication is required for exploitation.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Spring Cloud Function 3.1.7 and 3.2.3

Vendor Advisory: https://tanzu.vmware.com/security/cve-2022-22963

Restart Required: Yes

Instructions:

1. Update Spring Cloud Function to version 3.1.7 or 3.2.3. 2. Update dependencies in your project configuration (pom.xml or build.gradle). 3. Rebuild and redeploy the application. 4. Restart all affected services.

🔧 Temporary Workarounds

Disable routing functionality

all

If routing functionality is not required, disable it to prevent exploitation.

spring.cloud.function.routing.enabled=false

Input validation filter

all

Implement a filter to reject requests containing SpEL expressions in routing parameters.

🧯 If You Can't Patch

Implement strict network segmentation to isolate vulnerable systems
Deploy web application firewall (WAF) rules to block malicious SpEL expressions

🔍 How to Verify

Check if Vulnerable:

Check Spring Cloud Function version in your application dependencies. If using 3.1.6, 3.2.2, or older versions, you are vulnerable.

Check Version:

Check pom.xml for <spring-cloud-function.version> or build.gradle for springCloudFunctionVersion

Verify Fix Applied:

Verify that Spring Cloud Function version is 3.1.7 or 3.2.3 in your dependencies after update.

📡 Detection & Monitoring

Log Indicators:

Unusual SpEL expressions in routing parameters
Unexpected process execution from Spring application
Error logs containing SpEL parsing exceptions

Network Indicators:

HTTP requests with crafted routing-expression parameters
Outbound connections from Spring applications to unexpected destinations

SIEM Query:

source="spring-app" AND (message="*SpEL*" OR message="*routing-expression*")

📊 Metadata

CVE ID: CVE-2022-22963

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-94

Published: April 1, 2022

Last Updated: October 30, 2025

🔗 References

http://packetstormsecurity.com/files/173430/Spring-Cloud-3.2.2-Remote-Command-Execution.html Exploit,Third Party Advisory,VDB Entry
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005 Third Party Advisory
https://tanzu.vmware.com/security/cve-2022-22963 Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-scf-rce-DQrHhJxH Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Patch,Third Party Advisory
http://packetstormsecurity.com/files/173430/Spring-Cloud-3.2.2-Remote-Command-Execution.html Exploit,Third Party Advisory,VDB Entry
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005 Third Party Advisory
https://tanzu.vmware.com/security/cve-2022-22963 Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-scf-rce-DQrHhJxH Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Patch,Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22963 US Government Resource

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Banking Branch by Oracle

Banking Cash Management by Oracle

Banking Corporate Lending Process Management by Oracle

Banking Credit Facilities Process Management by Oracle

Banking Electronic Data Exchange For Corporates by Oracle

Banking Liquidity Management by Oracle

Banking Liquidity Management by Oracle

Banking Origination by Oracle

Banking Supply Chain Finance by Oracle

Banking Trade Finance Process Management by Oracle

Banking Virtual Account Management by Oracle

Communications Cloud Native Core Automated Test Suite by Oracle

Communications Cloud Native Core Automated Test Suite by Oracle

Communications Cloud Native Core Console by Oracle

Communications Cloud Native Core Console by Oracle

Communications Cloud Native Core Network Exposure Function by Oracle

Communications Cloud Native Core Network Function Cloud Native Environment by Oracle

Communications Cloud Native Core Network Function Cloud Native Environment by Oracle

Communications Cloud Native Core Network Function Cloud Native Environment by Oracle

Communications Cloud Native Core Network Repository Function by Oracle

Communications Cloud Native Core Network Repository Function by Oracle

Communications Cloud Native Core Network Slice Selection Function by Oracle

Communications Cloud Native Core Network Slice Selection Function by Oracle

Communications Cloud Native Core Policy by Oracle

Communications Cloud Native Core Policy by Oracle

Communications Cloud Native Core Policy by Oracle

Communications Cloud Native Core Security Edge Protection Proxy by Oracle

Communications Cloud Native Core Security Edge Protection Proxy by Oracle

Communications Cloud Native Core Unified Data Repository by Oracle

Communications Cloud Native Core Unified Data Repository by Oracle

Communications Communications Policy Management by Oracle

Financial Services Analytical Applications Infrastructure by Oracle

Financial Services Analytical Applications Infrastructure by Oracle

Financial Services Behavior Detection Platform by Oracle

Financial Services Behavior Detection Platform by Oracle

Financial Services Behavior Detection Platform by Oracle

Financial Services Enterprise Case Management by Oracle

Financial Services Enterprise Case Management by Oracle

Financial Services Enterprise Case Management by Oracle

Mysql Enterprise Monitor by Oracle

Product Lifecycle Analytics by Oracle

Retail Xstore Point Of Service by Oracle

Retail Xstore Point Of Service by Oracle

Sd Wan Edge by Oracle

Sd Wan Edge by Oracle

Spring Cloud Function by Vmware

Spring Cloud Function by Vmware

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable routing functionality

Input validation filter

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities