In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing
    functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that
    may result in remote code execution and access to local resources. (CVE-2022-22963)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:1291 advisory.

    Red Hat OpenShift Serverless Client kn 1.21.1 provides a CLI to interact with Red Hat OpenShift Serverless     1.21.1. The kn CLI is delivered as an RPM package for installation on RHEL platforms, and as binaries for     non-Linux platforms.

    Security Fix(es):

    * spring-cloud-function: Remote code execution by malicious Spring Expression (CVE-2022-22963)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Spring Cloud Function running on the remote host is affected by a remote code execution vulnerability in the routing functionality. A remote, unauthenticated attacker could provide a specially crafted SpEL as a routing expression that may result in remote code execution on the remote host.

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in access to local resources.

ID	Name	Product	Family	Severity
411627	SCA: security update for org.springframework.cloud:spring-cloud-function-context (GHSA-6v73-fgf6-w5j7)	Tenable Cloud Security	SCA Checks	critical
411627	SCA: security update for org.springframework.cloud:spring-cloud-function-context (GHSA-6v73-fgf6-w5j7)	Tenable Self-Hosted Container Security	SCA Checks	critical
194277	RHEL 8 : Release of OpenShift Serverless Client kn 1.21.1 (Low) (RHSA-2022:1291)	Nessus	Red Hat Local Security Checks	critical
159730	VMware Spring Cloud Function < 3.1.7 / 3.2.x < 3.2.3 SPEL Expression Injection (local check)	Nessus	Misc.	critical
159375	Spring Cloud Function SPEL Expression Injection (direct check)	Nessus	CGI abuses	critical
113214	Spring Cloud Function < 3.1.7 / 3.2.X < 3.2.3 Remote Code Execution	Web App Scanning	Component Vulnerability	critical

Detections

Analytics

CVE-2022-22963

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical