CVE-2022-22968: Spring Framework Auth Bypass Vulnerability

CVE-2022-22968 Overview

CVE-2022-22968 affects the Spring Framework DataBinder component in versions 5.3.0 through 5.3.18 and 5.2.0 through 5.2.20, as well as older unsupported releases. The flaw stems from case-sensitive pattern matching in the disallowedFields configuration. Applications relying on disallowedFields to block sensitive properties remain exposed unless every field is listed with both upper and lower case variants for the first character, including all nested properties. This weakness is categorized under [CWE-178: Improper Handling of Case Sensitivity]. The vulnerability impacts numerous downstream products from NetApp, Oracle, and VMware that embed Spring Framework.

Critical Impact
Attackers can submit HTTP parameters that bypass disallowedFields filters by altering the case of field names, allowing manipulation of fields the developer intended to protect.

Affected Products

VMware Spring Framework 5.3.0 – 5.3.18 and 5.2.0 – 5.2.20
NetApp Active IQ Unified Manager, Cloud Secure Agent, MetroCluster Tiebreaker, Snap Creator Framework, SnapManager
Oracle MySQL Enterprise Monitor

Discovery Timeline

2022-04-14 - CVE-2022-22968 published to the National Vulnerability Database
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-22968

Vulnerability Analysis

The Spring DataBinder class binds HTTP request parameters to Java object properties. Developers configure disallowedFields patterns to prevent mass assignment attacks against sensitive fields such as isAdmin or account.balance. The patterns, however, are matched in a case-sensitive manner. An attacker can submit a parameter with a different case for the first character of any path segment to evade the filter.

For example, configuring disallowedFields with id does not block submissions using Id, iD, or ID. Nested paths compound the problem because every segment of the property path must be enumerated with both case variants. This vulnerability is a follow-up hardening fix to the well-known Spring4Shell ecosystem, narrowing the bypass surface of DataBinder. The EPSS score sits at 20.51%, placing it in the 95th percentile of CVEs likely to be exploited.

Root Cause

The org.springframework.validation.DataBinder field-matching logic compares incoming parameter names against disallowedFields patterns without normalizing case. The internal isAllowed check applies pattern matching directly on raw input, leaving case variants unchecked. Developers reasonably assumed pattern matching was case-insensitive.

Attack Vector

Attackers exploit the flaw remotely over the network without authentication or user interaction. An adversary sends an HTTP request containing parameters whose names differ only in capitalization from the blocked field. The DataBinder binds the attacker-controlled value to the underlying Java object, enabling mass assignment to fields the application intended to protect. Successful exploitation typically results in integrity impact, such as privilege flags or business-logic state being overwritten. Refer to the VMware CVE Analysis for protocol-level technical details.

Detection Methods for CVE-2022-22968

Indicators of Compromise

HTTP form submissions or query strings containing parameter names that mirror sensitive fields but with altered case (e.g., Role, IsAdmin, Account.Balance)
Application audit logs showing modifications to properties not exposed by the standard UI workflow
Spring Boot logs showing successful binding to properties absent from the documented form schema

Detection Strategies

Inspect web access logs for parameter name collisions where only the case differs from documented field names
Compare bound object state before and after request handling to detect unexpected field mutation
Deploy WAF rules that normalize parameter name case and reject requests containing reserved field identifiers

Monitoring Recommendations

Monitor Spring MVC controllers using @ModelAttribute and WebDataBinder.setDisallowedFields for anomalous binding activity
Alert on changes to privileged object fields originating from unauthenticated or low-privilege sessions
Correlate application logs with identity events to detect mass-assignment-driven privilege escalation attempts

How to Mitigate CVE-2022-22968

Immediate Actions Required

Upgrade Spring Framework to version 5.3.19 or 5.2.21 or later, which apply case-insensitive matching to disallowedFields
Apply the appropriate vendor patches for NetApp products listed in the NetApp Security Advisory
Install the July 2022 Oracle Critical Patch Update for MySQL Enterprise Monitor per the Oracle Critical Patch Update
Audit application code for setDisallowedFields usage and validate field protection assumptions

Patch Information

VMware released fixed Spring Framework versions 5.3.19 and 5.2.21 on April 14, 2022. The patch changes DataBinder field matching to be case-insensitive so configured disallowedFields patterns block all case variants. Details are available in the VMware CVE Analysis.

Workarounds

Explicitly enumerate every case variant of disallowed fields, including nested path segments, until patching is possible
Prefer allowedFields over disallowedFields to apply an allow-list model that ignores unexpected case variants
Use Data Transfer Object (DTO) classes that expose only the properties intended for client binding, eliminating sensitive fields from the bind target
Add server-side authorization checks that validate field-level changes regardless of binding outcome

bash

# Example: switch from disallowedFields to allowedFields in a Spring controller
@InitBinder
public void initBinder(WebDataBinder binder) {
    binder.setAllowedFields("name", "email", "address.street", "address.city");
}