CVE-2022-31691: VMware Bosh Editor RCE Vulnerability

CVE-2022-31691 Overview

CVE-2022-31691 is a critical remote code execution vulnerability affecting Spring Tools 4 for Eclipse version 4.16.0 and below, as well as several VSCode extensions including Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor, and Cloudfoundry Manifest YML Support version 1.39.0 and below. The vulnerability stems from the use of the Snakeyaml library for YAML editing support, which allows special syntax in YAML files that can be exploited by attackers to execute arbitrary code remotely under certain circumstances.

Critical Impact

This vulnerability allows attackers to achieve remote code execution through maliciously crafted YAML files processed by the affected development tools, potentially compromising developer workstations and CI/CD pipelines.

Affected Products

• VMware Spring Tools 4 for Eclipse (versions ≤ 4.16.0)
• VMware Spring Boot Tools VSCode Extension (versions ≤ 1.39.0)
• VMware Concourse CI Pipeline Editor VSCode Extension (versions ≤ 1.39.0)
• VMware Bosh Editor VSCode Extension (versions ≤ 1.39.0)
• VMware Cloudfoundry Manifest YML Support VSCode Extension (versions ≤ 1.39.0)

Discovery Timeline

• 2022-11-04 - CVE-2022-31691 published to NVD
• 2025-05-02 - Last updated in NVD database

Technical Details for CVE-2022-31691

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code, also known as Code Injection). The flaw exists in the Snakeyaml library dependency used by the affected VMware development tools for YAML parsing and editing functionality. Snakeyaml's default configuration allows for unsafe YAML deserialization, which permits specially crafted YAML syntax to instantiate arbitrary Java objects and invoke methods during the parsing process.

When a developer opens or processes a malicious YAML file in the affected Eclipse or VSCode extensions, the Snakeyaml parser interprets the special YAML constructs that can lead to arbitrary code execution. This is particularly dangerous in development environments where YAML files from external sources (such as Git repositories, configuration templates, or shared project files) are regularly opened and edited.

Root Cause

The root cause of this vulnerability lies in the unsafe default configuration of the Snakeyaml YAML parsing library. Snakeyaml supports advanced YAML features including custom type tags that allow for object instantiation during parsing. Without proper restrictions on which types can be instantiated, attackers can craft YAML payloads that trigger instantiation of dangerous Java classes, leading to code execution. The affected Spring Tools and VSCode extensions did not implement adequate safeguards to restrict or sanitize YAML content before processing.

Attack Vector

The attack vector for CVE-2022-31691 is network-based, requiring no privileges or user interaction beyond the victim opening a malicious YAML file. An attacker could exploit this vulnerability through several scenarios:

1. Supply Chain Attack: Compromising a Git repository with malicious YAML configuration files that get opened by developers using the affected tools
2. Phishing: Sending malicious YAML files to developers via email or messaging platforms
3. Shared Development Resources: Placing crafted YAML files in shared network drives or cloud storage accessed by development teams
4. CI/CD Pipeline Compromise: Injecting malicious YAML into pipelines that use Concourse CI Pipeline Editor

The vulnerability leverages Snakeyaml's ability to parse YAML tags that specify Java class constructors, allowing attackers to instantiate arbitrary objects with controlled parameters. Technical details regarding specific payload construction can be found in the VMware Security Advisory.

Detection Methods for CVE-2022-31691

Indicators of Compromise

• Unexpected YAML files containing Java class references or type tags (e.g., !!java.lang.Runtime, !!java.lang.ProcessBuilder)
• Unusual process spawning from Eclipse or VSCode processes after opening YAML files
• Network connections initiated from IDE processes to unknown external hosts
• Presence of suspicious YAML files with complex nested structures or encoded payloads in project directories

Detection Strategies

• Monitor IDE processes for unexpected child process creation or network activity
• Implement file integrity monitoring on development workstations to detect suspicious YAML modifications
• Deploy endpoint detection rules to identify Snakeyaml deserialization attack patterns
• Review recently accessed YAML files in development environments for malicious constructs
• Enable verbose logging in development tools to capture YAML parsing activities

Monitoring Recommendations

• Configure SentinelOne Singularity to monitor Eclipse and VSCode processes for behavioral anomalies
• Establish baseline behavior for developer workstations and alert on deviations
• Implement network monitoring to detect unusual outbound connections from IDE applications
• Set up alerts for process injection or code execution attempts originating from development tools

How to Mitigate CVE-2022-31691

Immediate Actions Required

• Update Spring Tools 4 for Eclipse to version 4.17.0 or later immediately
• Update all affected VSCode extensions (Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor, Cloudfoundry Manifest YML Support) to version 1.40.0 or later
• Review recently opened YAML files in development environments for suspicious content
• Audit development repositories for potentially malicious YAML files
• Notify development teams about the risk of opening untrusted YAML files

Patch Information

VMware has released security updates to address this vulnerability. The fixes restrict the Snakeyaml configuration to prevent unsafe object instantiation during YAML parsing. Organizations should update to the following minimum versions:

• Spring Tools 4 for Eclipse: Version 4.17.0 or later
• VSCode Extensions (Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor, Cloudfoundry Manifest YML Support): Version 1.40.0 or later

Detailed patch information is available in the VMware Security Advisory CVE-2022-31691.

Workarounds

• Avoid opening YAML files from untrusted or unknown sources until patches are applied
• Implement strict code review policies for YAML files in version control systems
• Use pre-commit hooks to scan YAML files for suspicious constructs before they enter repositories
• Consider using alternative YAML editors that do not rely on vulnerable Snakeyaml configurations
• Isolate development environments with network segmentation to limit potential blast radius

# Configuration example - Check installed extension versions in VSCode
code --list-extensions --show-versions | grep -E "(vscjava.vscode-spring-boot|Pivotal.vscode-concourse|Pivotal.vscode-bosh|Pivotal.vscode-manifest-yaml)"

# Update VSCode extensions via command line
code --install-extension vscjava.vscode-spring-boot --force
code --install-extension Pivotal.vscode-concourse --force
code --install-extension Pivotal.vscode-bosh --force
code --install-extension Pivotal.vscode-manifest-yaml --force