Almost a Fifth of Global Firms Targeted with Spring4Shell

CVE-2022-22947 is a code injection (Spring Expression Language injection) flaw in VMware Spring Cloud Gateway that allows arbitrary remote code execution when the Gateway Actuator endpoint is enabled, exposed, and unsecured. A remote, unauthenticated attacker can send a maliciously crafted request (typically a crafted POST to the gateway actuator routes endpoint) that is evaluated as code, letting the attacker run arbitrary commands on the host. The CVSS 3.1 score is 10.0 (critical) because exploitation is network-based, requires no privileges or user interaction, and impacts confidentiality, integrity, and availability beyond the vulnerable component. All Spring Cloud Gateway deployments prior to 3.1.1/3.0.7 are affected, along with Oracle products that embed the component, including Commerce Guided Search and multiple Oracle Communications Cloud Native Core functions. Exploitation is confirmed: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-05-16, EPSS puts the 30-day exploitation probability at 98.3% (100th percentile), public PoC exploits exist, and related reporting describes botnets adding Spring Cloud Gateway exploits to their attack tooling.

Do: Upgrade Spring Cloud Gateway to 3.1.1 or later, or to 3.0.7 or later on the 3.0.x line, per VMware's advisory, and apply the relevant Oracle Critical Patch Update for affected Oracle Commerce Guided Search and Communications Cloud Native Core products. If you cannot patch immediately, disable or restrict the Gateway Actuator endpoint so it is not reachable over the network without authentication. Scan for exposed gateway actuator endpoints and review hosts for signs of command execution; this flaw is on CISA's KEV list, which requires applying updates per vendor instructions.

VMware Tanzu's Spring Cloud Function contains a remote code execution flaw (CWE-94, expression-language code injection) in its routing functionality. When the routing feature evaluates an attacker-supplied Spring Expression Language (SpEL) routing-expression, a specially crafted expression is processed by the framework, resulting in arbitrary code execution on the server and access to local resources. Any deployment of Spring Cloud Function that evaluates untrusted routing-expressions, typically via exposed application endpoints, is affected. An attacker who can reach such an endpoint gains code execution in the context of the running application, which can lead to data theft, lateral movement, or ransomware. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2022-08-25 and EPSS rates the 30-day exploitation probability at 99.9% (100th percentile), although no public PoC is cataloged in this data.

Do: Apply the vendor update per VMware/Tanzu instructions immediately, as patching is the required action for this KEV-listed vulnerability. Until patched, prevent untrusted clients from supplying the routing-expression (restrict or disable the routing functionality) and limit network exposure of affected services. Review application logs for unexpected SpEL payloads in routing-expressions and check affected hosts for indicators of compromise, including ransomware staging.

CVE-2022-22965 ('Spring4Shell') is a critical (CVSS 9.8) remote code execution flaw in VMware's Spring Framework, caused by insecure data binding that lets unauthenticated attackers overwrite internal class and module properties through crafted request parameters (CWE-94, code injection). It affects Spring MVC and Spring WebFlux applications running on JDK 9 or later; the demonstrated exploit path requires a Tomcat WAR deployment, while applications packaged as Spring Boot executable jars are not exploitable that way, though the underlying issue may be reachable via other routes. A successful attack yields full remote code execution with the privileges of the application server, with no authentication or user interaction required. VMware Spring Framework 5.3.0-5.3.17 and 5.2.0-5.2.19 (plus older releases) are affected, and the flaw also impacts bundled products from Cisco, Oracle, Siemens and Veritas, including multiple Oracle Communications Cloud Native Core components. It is being actively exploited in the wild: added to CISA's KEV on 2022-04-04, EPSS puts 30-day exploitation probability at 99.6% (100th percentile), a public PoC is available, and mass scanning of vulnerable servers has been observed.

Do: Upgrade Spring Framework to 5.3.18, 5.2.20 or later (or apply vendor-supplied fixes for bundled products, e.g., via Oracle's patch release and Cisco's advisory), prioritizing internet-facing Tomcat WAR deployments on JDK 9+; this is a CISA KEV entry, so treat patching as urgent. If patching must wait, mitigate by running on JDK 8, deploying as a Spring Boot executable jar rather than a WAR on Tomcat, and applying the vendor-documented workaround that disallows 'class.*', 'Class.*' and 'module.*' fields in data binding. Inventory exposed Tomcat/Spring services and hunt for signs of exploitation given confirmed in-the-wild use.