CVE-2022-22968: Spring Framework Auth Bypass Vulnerability

CVE-2022-22968 Overview

CVE-2022-22968 affects the Spring Framework DataBinder component in versions 5.3.0 through 5.3.18 and 5.2.0 through 5.2.20, as well as older unsupported releases. The flaw stems from case-sensitive pattern matching in the disallowedFields configuration. Applications relying on disallowedFields to block sensitive properties remain exposed unless every field is listed with both upper and lower case variants for the first character, including all nested properties. This weakness is categorized under [CWE-178: Improper Handling of Case Sensitivity]. The vulnerability impacts numerous downstream products from NetApp, Oracle, and VMware that embed Spring Framework.

Critical Impact

Attackers can submit HTTP parameters that bypass disallowedFields filters by altering the case of field names, allowing manipulation of fields the developer intended to protect.

Affected Products

• VMware Spring Framework 5.3.0 – 5.3.18 and 5.2.0 – 5.2.20
• NetApp Active IQ Unified Manager, Cloud Secure Agent, MetroCluster Tiebreaker, Snap Creator Framework, SnapManager
• Oracle MySQL Enterprise Monitor

Discovery Timeline

• 2022-04-14 - CVE-2022-22968 published to the National Vulnerability Database
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-22968

Vulnerability Analysis

The Spring DataBinder class binds HTTP request parameters to Java object properties. Developers configure disallowedFields patterns to prevent mass assignment attacks against sensitive fields such as isAdmin or account.balance. The patterns, however, are matched in a case-sensitive manner. An attacker can submit a parameter with a different case for the first character of any path segment to evade the filter.

For example, configuring disallowedFields with id does not block submissions using Id, iD, or ID. Nested paths compound the problem because every segment of the property path must be enumerated with both case variants. This vulnerability is a follow-up hardening fix to the well-known Spring4Shell ecosystem, narrowing the bypass surface of DataBinder. The EPSS score sits at 20.51%, placing it in the 95th percentile of CVEs likely to be exploited.

Root Cause

The org.springframework.validation.DataBinder field-matching logic compares incoming parameter names against disallowedFields patterns without normalizing case. The internal isAllowed check applies pattern matching directly on raw input, leaving case variants unchecked. Developers reasonably assumed pattern matching was case-insensitive.

Attack Vector

Attackers exploit the flaw remotely over the network without authentication or user interaction. An adversary sends an HTTP request containing parameters whose names differ only in capitalization from the blocked field. The DataBinder binds the attacker-controlled value to the underlying Java object, enabling mass assignment to fields the application intended to protect. Successful exploitation typically results in integrity impact, such as privilege flags or business-logic state being overwritten. Refer to the VMware CVE Analysis for protocol-level technical details.

Detection Methods for CVE-2022-22968

Indicators of Compromise

• HTTP form submissions or query strings containing parameter names that mirror sensitive fields but with altered case (e.g., Role, IsAdmin, Account.Balance)
• Application audit logs showing modifications to properties not exposed by the standard UI workflow
• Spring Boot logs showing successful binding to properties absent from the documented form schema

Detection Strategies

• Inspect web access logs for parameter name collisions where only the case differs from documented field names
• Compare bound object state before and after request handling to detect unexpected field mutation
• Deploy WAF rules that normalize parameter name case and reject requests containing reserved field identifiers

Monitoring Recommendations

• Monitor Spring MVC controllers using @ModelAttribute and WebDataBinder.setDisallowedFields for anomalous binding activity
• Alert on changes to privileged object fields originating from unauthenticated or low-privilege sessions
• Correlate application logs with identity events to detect mass-assignment-driven privilege escalation attempts

How to Mitigate CVE-2022-22968

Immediate Actions Required

• Upgrade Spring Framework to version 5.3.19 or 5.2.21 or later, which apply case-insensitive matching to disallowedFields
• Apply the appropriate vendor patches for NetApp products listed in the NetApp Security Advisory
• Install the July 2022 Oracle Critical Patch Update for MySQL Enterprise Monitor per the Oracle Critical Patch Update
• Audit application code for setDisallowedFields usage and validate field protection assumptions

Patch Information

VMware released fixed Spring Framework versions 5.3.19 and 5.2.21 on April 14, 2022. The patch changes DataBinder field matching to be case-insensitive so configured disallowedFields patterns block all case variants. Details are available in the VMware CVE Analysis.

Workarounds

• Explicitly enumerate every case variant of disallowed fields, including nested path segments, until patching is possible
• Prefer allowedFields over disallowedFields to apply an allow-list model that ignores unexpected case variants
• Use Data Transfer Object (DTO) classes that expose only the properties intended for client binding, eliminating sensitive fields from the bind target
• Add server-side authorization checks that validate field-level changes regardless of binding outcome

# Example: switch from disallowedFields to allowedFields in a Spring controller
@InitBinder
public void initBinder(WebDataBinder binder) {
    binder.setAllowedFields("name", "email", "address.street", "address.city");
}