WaratekVRT Sign in

CVE-2022-22963 Spring Cloud Function

Affected softwareSpring Cloud Function
Severity9.8 Critical CVSS 3.1 3 scores
Fixed in3.2.3, 3.1.7
WeaknessCode injection (CWE-94)
Published1 Apr 2022
Updated17 Jun 2026

Description

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

CWE-917 · Expression language injection

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2022-08-25 · remediation due 2022-09-15 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 16 citations · honeypot sightings · 31 exploits · earliest 2022-08-19.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
  • Indexed PoC 30 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Metasploit, Nuclei; first seen 2022-03-26.
  • EPSS 99.9% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2022-22963 in VulnCheck (free account), which lists 11 more citations and 26 more exploit references not shown here.

EvidenceSourceDetailDate
Honeypot sighting Shadowserver honeypots Exploitation attempts seen on 107 days 2023-11-18 to 2026-10-27
Honeypot sighting VulnCheck canaries Exploitation attempts seen on 56 days 2025-10-17 to 2026-11-05
Reported exploitation unit42.paloaltonetworks.com /recent-exploits-network-security-trends 2022-08-19
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2022-08-25
Reported exploitation web-assets.esetstatic.com /wls/2023/07/eset_threat_report_h12023.pdf 2023-07-11
Reported exploitation cisa.gov /news-events/cybersecurity-advisories/aa23-215a 2023-08-03
Reported exploitation media.kasperskycontenthub.com /wp-content/uploads/sites/43/2023/11/09055246/Modern-Asian-APT-groups-TTPs_report_eng.pdf 2023-11-09
Exploit reference VulnCheck XDB 9e2b9c965b80 Exploit type: initial-access 2022-03-26
Exploit reference VulnCheck XDB 5922af7bf5b9 Exploit type: initial-access 2022-03-30
Exploit reference VulnCheck XDB 8fdc0fdf513e Exploit type: initial-access 2022-03-30
Exploit reference VulnCheck XDB 45486f0fb795 Exploit type: initial-access 2022-03-31
Exploit reference VulnCheck XDB 8555580d563a Exploit type: initial-access 2022-03-31
IndexArtifactStarsFirst seen
GitHub PoC spring-cloud / spring-cloud-function,spring.cloud.function.routing-expression,RCE,0day,0-day,POC,EXP,CVE-2022-22963 355 2022-03-26
Nuclei Spring Cloud - Remote Code Execution
Exploit-DB Spring Cloud 3.2.2 - Remote Command Execution (RCE) 2023-07-11
Metasploit Spring Cloud Function SpEL Injection (excellent rank)
GitHub PoC CVE-2022-22963 PoC 119 2022-03-30
GitHub PoC darryk10/CVE-2022-22963 34 2022-03-30
GitHub PoC CVE-2022-22963 is a vulnerability in the Spring Cloud Function Framework for Java that allows remote code execution. This python script will verify if the vulnerability exists, and if it does, will give you a reverse shell. 24 2023-03-18
GitHub PoC Spring Cloud Function Vulnerable Application / CVE-2022-22963 19 2022-03-31
GitHub PoC CVE-2022-22963 Spring-Cloud-Function-SpEL_RCE_exploit 15 2022-03-30
GitHub PoC This includes CVE-2022-22963, a Spring SpEL / Expression Resource Access Vulnerability, as well as CVE-2022-22965, the spring-webmvc/spring-webflux RCE termed "SpringShell". 14 2022-03-31

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

  • Protection full
  • Action available security rule
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Protected by Waratek.

How to mitigate CVE-2022-22963

Upgrade Spring Cloud Function to a release that fixes it: 3.2.3 or 3.1.7. Until you can, Waratek RASP blocks exploitation with a security rule that blocks this kind of attack. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA-ADP Secondary
CVSS 2.0 7.5 none AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update July 2022 ↗ CPU 2022-Q3 Oracle Communications / DBTier (Spring Cloud Function) (22.1.2)
Oracle Communications / Policy (Spring Cloud Function) (22.1.3)
Oracle Financial Services Applications / Common (Spring Cloud Function) (14.2, 14.5)
Oracle Financial Services Applications / Common (Spring Cloud Function) (14.5)
Oracle Financial Services Applications / Common (Spring Cloud Function) (14.5)
Oracle Financial Services Applications / Common (Spring Cloud Function) (14.5)
Oracle Financial Services Applications / Common (Spring Cloud Function) (14.5)
Oracle Financial Services Applications / Common (Spring Cloud Function) (14.5)
Oracle Financial Services Applications / Common (Spring Cloud Function) (14.5)
Oracle Financial Services Applications / Common (Spring Cloud Function) (14.5)
Oracle Financial Services Applications / Common (Spring Cloud Function) (14.5)
Oracle Financial Services Applications / Common (Spring Cloud Function) (14.5)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Communications DBTier (Spring Cloud Function) 22.1.2 22.1.2
Oracle Communications Policy (Spring Cloud Function) 22.1.3 22.1.3
Oracle Financial Services Applications Common (Spring Cloud Function) 14.2, 14.5 14.2 · 14.5

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.springframework.cloud:spring-cloud-function-context 3.2.0 3.2.3 unbounded
org.springframework.cloud:spring-cloud-function-context 0 3.1.7 unbounded

Products and versions

29 products, 49 version entries
SourceVendorProductSchemeAffected versions
nvd oracle banking branch generic 14.5
nvd oracle banking cash management generic 14.5
nvd oracle banking corporate lending process management generic 14.5
nvd oracle banking credit facilities process management generic 14.5
nvd oracle banking electronic data exchange for corporates generic 14.5
nvd oracle banking liquidity management generic 14.2 · 14.5
nvd oracle banking origination generic 14.5
nvd oracle banking supply chain finance generic 14.5
nvd oracle banking trade finance process management generic 14.5
nvd oracle banking virtual account management generic 14.5
nvd oracle communications cloud native core automated test suite generic 1.9.0 · 22.1.0
nvd oracle communications cloud native core console generic 1.9.0 · 22.1.0
nvd oracle communications cloud native core network exposure function generic 22.1.0
nvd oracle communications cloud native core network function cloud native environment generic 1.10.0 · 22.1.0 · 22.1.2
nvd oracle communications cloud native core network repository function generic 1.15.0 · 22.1.0
nvd oracle communications cloud native core network slice selection function generic 1.8.0 · 22.1.0
nvd oracle communications cloud native core policy generic 1.15.0 · 22.1.0 · 22.1.3
nvd oracle communications cloud native core security edge protection proxy generic 1.7.0 · 22.1.0
nvd oracle communications cloud native core unified data repository generic 1.15.0 · 22.1.0
nvd oracle communications communications policy management generic 12.6.0.0.0
nvd oracle financial services analytical applications infrastructure generic 8.1.1.0 · 8.1.2.0
nvd oracle financial services behavior detection platform generic 8.1.1.0 · 8.1.1.1 · 8.1.2.0
nvd oracle financial services enterprise case management generic 8.1.1.0 · 8.1.1.1 · 8.1.2.0
nvd oracle mysql enterprise monitor generic ≤ 8.0.29
nvd oracle product lifecycle analytics generic 3.6.1.0
nvd oracle retail xstore point of service generic 20.0.1 · 21.0.0
nvd oracle sd-wan edge generic 9.0 · 9.1
osv org.springframework.cloud spring-cloud-function-context generic ＜ 3.1.7 · ≥ 3.2.0 and ＜ 3.2.3
nvd vmware spring cloud function generic ≤ 3.1.6 · ≥ 3.2.0 and ≤ 3.2.2

References

URLTags
https://github.com/spring-cloud/spring-cloud-function PACKAGE
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005 WEB
https://tanzu.vmware.com/security/cve-2022-22963 WEB
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-scf-rce-DQrHhJxH WEB
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22963 WEB
https://www.oracle.com/security-alerts/cpuapr2022.html WEB
https://www.oracle.com/security-alerts/cpujul2022.html WEB
http://packetstormsecurity.com/files/173430/Spring-Cloud-3.2.2-Remote-Command-Execution.html WEB

Timeline
Published2022-04-01By the CVE Program.
VulnCheck KEV: earliest evidence2022-08-19Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Added to CISA KEV2022-08-25Listed in CISA's Known Exploited Vulnerabilities catalog.
NVD record modified2026-06-17NVD's own last-modified date for this record.
VulnCheck KEV: latest evidence2026-11-10Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.