CVE-2022-22963: Spring Cloud Function RCE Vulnerability

CVE-2022-22963 Overview

CVE-2022-22963 is a critical remote code execution (RCE) vulnerability affecting VMware Spring Cloud Function versions 3.1.6, 3.2.2, and older unsupported versions. The vulnerability exists in the routing functionality, where an attacker can provide a specially crafted Spring Expression Language (SpEL) expression as a routing-expression that results in remote code execution and unauthorized access to local resources on the target system.

This vulnerability is particularly dangerous because it can be exploited remotely without authentication, allowing attackers to execute arbitrary commands on vulnerable servers. The flaw stems from improper input validation of SpEL expressions passed through HTTP request headers, enabling expression language injection attacks.

Critical Impact

This vulnerability enables unauthenticated remote code execution through SpEL injection, allowing attackers to fully compromise affected systems. CISA has added this to the Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.

Affected Products

• VMware Spring Cloud Function versions 3.1.6 and earlier
• VMware Spring Cloud Function versions 3.2.2 and earlier
• Oracle Banking Branch 14.5
• Oracle Banking Cash Management 14.5
• Oracle Banking Corporate Lending Process Management 14.5
• Oracle Banking Credit Facilities Process Management 14.5
• Oracle Banking Electronic Data Exchange for Corporates 14.5
• Oracle Banking Liquidity Management 14.2 and 14.5
• Oracle Banking Origination 14.5
• Oracle Banking Supply Chain Finance 14.5
• Oracle Banking Trade Finance Process Management 14.5
• Oracle Banking Virtual Account Management 14.5
• Oracle Communications Cloud Native Core (multiple components)
• Oracle Financial Services Analytical Applications Infrastructure 8.1.1.0 and 8.1.2.0
• Oracle Financial Services Behavior Detection Platform 8.1.1.0, 8.1.1.1, and 8.1.2.0
• Oracle Financial Services Enterprise Case Management 8.1.1.0, 8.1.1.1, and 8.1.2.0
• Oracle MySQL Enterprise Monitor (various versions up to 8.0.29)
• Oracle Product Lifecycle Analytics 3.6.1.0
• Oracle Retail Xstore Point of Service 20.0.1 and 21.0.0
• Oracle SD-WAN Edge 9.0 and 9.1

Discovery Timeline

• April 1, 2022 - CVE-2022-22963 published to NVD
• October 30, 2025 - Last updated in NVD database

Technical Details for CVE-2022-22963

Vulnerability Analysis

This vulnerability is classified as a Code Injection (CWE-94) and Expression Language Injection (CWE-917) flaw. The root cause lies in the unsafe handling of Spring Expression Language (SpEL) expressions within the routing functionality of Spring Cloud Function.

When Spring Cloud Function is configured to use routing functionality, it processes HTTP requests and evaluates routing expressions to determine which function should handle the request. The vulnerability allows an attacker to inject malicious SpEL expressions through the spring.cloud.function.routing-expression HTTP header, which are then evaluated by the application without proper sanitization.

SpEL is a powerful expression language that supports features like method invocation and object instantiation. When user-controlled input is passed directly to the SpEL evaluation engine, attackers can leverage these capabilities to execute arbitrary Java code, leading to complete system compromise.

Root Cause

The vulnerability stems from insufficient input validation and sanitization of user-supplied SpEL expressions in the routing mechanism. When processing incoming HTTP requests, the application reads the routing expression from request headers and passes it directly to the SpEL parser for evaluation. This allows attackers to craft expressions that invoke arbitrary methods, access the Java runtime, and execute system commands.

The lack of a proper sandbox or expression allowlist means any valid SpEL expression can be evaluated, including those that instantiate dangerous classes like java.lang.Runtime for command execution.

Attack Vector

The attack is executed remotely over the network by sending specially crafted HTTP POST requests to vulnerable Spring Cloud Function endpoints. The attacker includes a malicious SpEL expression in the spring.cloud.function.routing-expression header.

A typical attack involves crafting a SpEL expression that uses Java reflection to access the system runtime and execute operating system commands. The expression typically retrieves an instance of java.lang.Runtime, invokes the exec() method with attacker-controlled commands, and may exfiltrate the output or establish a reverse shell.

The attack requires no authentication, no user interaction, and can be executed from any network location that can reach the vulnerable endpoint. For detailed technical analysis and proof-of-concept examples, refer to the Packet Storm Security Advisory.

Detection Methods for CVE-2022-22963

Indicators of Compromise

• HTTP POST requests containing spring.cloud.function.routing-expression headers with suspicious SpEL expressions
• Requests containing Java class references such as java.lang.Runtime, ProcessBuilder, or reflection-related classes in HTTP headers
• Unexpected process spawning from Java application processes, particularly shell commands (/bin/bash, cmd.exe, powershell.exe)
• Network connections to unknown external IP addresses originating from application servers
• Log entries showing SpEL evaluation errors or unusual routing expression processing

Detection Strategies

• Deploy Web Application Firewalls (WAF) with rules to detect SpEL injection patterns in HTTP headers, specifically looking for expressions containing T(, Runtime, exec(, and similar suspicious patterns
• Implement network intrusion detection signatures to identify exploitation attempts targeting the spring.cloud.function.routing-expression header
• Monitor application logs for unusual SpEL expression evaluation or routing errors that may indicate attempted exploitation
• Use endpoint detection and response (EDR) solutions to identify suspicious child processes spawned by Java applications
• Conduct regular vulnerability scanning to identify unpatched Spring Cloud Function instances in your environment

Monitoring Recommendations

• Enable verbose logging for Spring Cloud Function routing functionality to capture all routing expression evaluations
• Implement centralized log collection and analysis with alerting for SpEL injection indicators
• Monitor for outbound network connections from application servers to detect potential command-and-control communications
• Track Java process behavior and flag any unexpected shell command executions or file system modifications
• Establish baseline application behavior and alert on deviations that may indicate post-exploitation activity

How to Mitigate CVE-2022-22963

Immediate Actions Required

• Upgrade Spring Cloud Function to version 3.1.7 or 3.2.3 or later immediately
• If immediate patching is not possible, disable the routing functionality in Spring Cloud Function until the upgrade can be completed
• Implement WAF rules to block requests containing the spring.cloud.function.routing-expression header with SpEL expressions
• Audit systems for signs of compromise, as this vulnerability has been actively exploited in the wild
• Review and restrict network access to Spring Cloud Function endpoints to trusted sources only

Patch Information

VMware has released patched versions of Spring Cloud Function. Organizations should upgrade to:

• Spring Cloud Function version 3.1.7 or later (for 3.1.x branch)
• Spring Cloud Function version 3.2.3 or later (for 3.2.x branch)

For Oracle products that bundle Spring Cloud Function, refer to the Oracle Critical Patch Update April 2022 and Oracle Critical Patch Update July 2022 advisories for specific patch guidance.

Additional security advisories are available from VMware Security Advisory, Cisco Security Advisory, and SonicWall Vulnerability Detail.

Workarounds

• Disable the routing functionality in Spring Cloud Function if not required by removing or commenting out routing-related configuration
• Implement strict input validation at the network perimeter to block requests with suspicious headers before they reach the application
• Deploy network segmentation to limit the exposure of vulnerable applications and restrict lateral movement in case of compromise
• Configure application firewalls to strip or reject requests containing the spring.cloud.function.routing-expression header entirely
• Consider deploying a reverse proxy that sanitizes or rejects potentially malicious header values before forwarding requests to backend applications

# Example: Block suspicious routing-expression headers with nginx
# Add to nginx server configuration
location / {
    if ($http_spring_cloud_function_routing_expression ~* "(Runtime|ProcessBuilder|exec|T\()") {
        return 403;
    }
    proxy_pass http://backend;
}