Spring Cloud Function SpEL Injection Remote Code Execution Vulnerability (CVE-2022-22963)
Executive & SecOps Summary
SECOPS ASSESSMENTSpring Cloud Function versions 3.1.6, 3.2.2, and older unsupported versions
Unauthenticated remote attackers can inject malicious SpEL expressions via HTTP headers to execute arbitrary system commands and access local resources.
Immediately upgrade Spring Cloud Function to version 3.1.7, 3.2.3, or higher, and block suspicious routing headers using WAF rules.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Upgrade your Spring Cloud Function dependencies to the patched versions (3.1.7 or higher, or 3.2.3 or higher). Update your build configuration files as shown below.
Maven ('pom.xml') Configuration:
<!-- Update dependency version in pom.xml -->
<dependency>
<groupId>org.springframework.cloud</groupId>
<artifactId>spring-cloud-function-context</artifactId>
<version>3.2.3</version>
</dependency>Gradle ('build.gradle') Configuration:
// Update dependency version in build.gradle\dependencies {
implementation 'org.springframework.cloud:spring-cloud-function-context:3.2.3'
}2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, configure your Web Application Firewall (WAF) or reverse proxy (e.g., Nginx) to drop requests containing the vulnerable routing header.
Nginx Configuration Example:
# Block requests containing the routing-expression header
server {
listen 80;
server_name localhost;
if ($http_spring_cloud_function_routing_expression ~* ".*") {
return 403 'Forbidden: Malicious Header Detected';
}
location / {
proxy_pass http://backend_servers;
}
}3. Log Audit & IoC Verification Commands
Inspect your application and web server logs for attempts to exploit the routing expression header.
Linux Terminal Commands for Log Auditing and Version Verification:
# 1. Search web server logs for the malicious routing header
grep -ri 'spring.cloud.function.routing-expression' /var/log/nginx/ /var/log/tomcat/ 2>/dev/null
# 2. Locate vulnerable Spring Cloud Function jar files in the system
find / -name 'spring-cloud-function-*.jar' 2>/dev/nullScan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability exists in the routing functionality of the Spring Cloud Function framework. Spring Cloud Function allows users to dynamically route requests to specific functions using the 'spring.cloud.function.routing-expression' HTTP header. Due to a lack of proper input validation and sandboxing before evaluating this header value, the Spring Expression Language (SpEL) engine directly parses and executes the user-supplied expression, leading to a critical SpEL injection vulnerability (CWE-94, CWE-917).
2. Exploitation Mechanics & Attack Scenario
An attacker sends a specially crafted HTTP POST request to a routing endpoint (such as '/functionRouter'). By including the 'spring.cloud.function.routing-expression' header containing a malicious SpEL payload, the attacker leverages the SpEL engine's capability to access Java classes and methods. For instance, injecting a payload like 'T(java.lang.Runtime).getRuntime().exec()' allows the attacker to bypass standard application logic and force the underlying operating system to execute arbitrary commands under the context of the application process.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical) and active exploitation documented in CISA's KEV catalog, this vulnerability poses an extreme risk to enterprise environments. Successful exploitation grants unauthenticated remote attackers full control over the affected container or server. This can lead to lateral movement within the internal network, data exfiltration, deployment of ransomware, or enrollment of the infrastructure into malicious botnets.
Official Vendor Advisories & References
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
Frequently Asked SecOps Questions (CVE-2022-22963)
FAQQ1. How critical is CVE-2022-22963 and is it actively exploited in the wild?
CVE-2022-22963 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.9%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2022-22963?
Primary impacted vendors include vmware, spring across spring_cloud_function. Scope summary: Spring Cloud Function versions 3.1.6 and older, 3.2.2 and older, and all unsupported legacy versions
Q3. What temporary mitigations or workarounds exist for CVE-2022-22963 before patching?
[Mitigation] Immediately upgrade Spring Cloud Function to version 3.1.7, 3.2.3, or higher, and block suspicious routing headers using WAF rules. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2022-22963
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (vmware)
View Category →Arista VeloCloud Orchestrator (VCO) On-Premises Remote Code Execution and Privilege Bypass (CVE-2026-16812)
[Affected Scope] On-premises deployments of VeloCloud Orchestrator (VCO)
VeloCloud Orchestrator (VCO) Privilege Escalation and Internal Access Vulnerability (CVE-2026-114625)
[Affected Scope] On-premise deployments of VeloCloud Orchestrator (VCO).
VMware vCenter Server Syslog Service Directory Traversal Remote Code Execution Vulnerability (CVE-2026-59310)
[Affected Scope] Systems running VMware vCenter Server with the built-in Syslog server service enabled.
VMware Aria Operations Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-22719)
[Affected Scope] VMware Aria Operations instances with support-assisted product migration in progress
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.