Spring4Shell: New info and fixes (CVE-2022-22965)

VMware Tanzu's Spring Cloud Function contains a remote code execution flaw (CWE-94, expression-language code injection) in its routing functionality. When the routing feature evaluates an attacker-supplied Spring Expression Language (SpEL) routing-expression, a specially crafted expression is processed by the framework, resulting in arbitrary code execution on the server and access to local resources. Any deployment of Spring Cloud Function that evaluates untrusted routing-expressions, typically via exposed application endpoints, is affected. An attacker who can reach such an endpoint gains code execution in the context of the running application, which can lead to data theft, lateral movement, or ransomware. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2022-08-25 and EPSS rates the 30-day exploitation probability at 99.9% (100th percentile), although no public PoC is cataloged in this data.

Do: Apply the vendor update per VMware/Tanzu instructions immediately, as patching is the required action for this KEV-listed vulnerability. Until patched, prevent untrusted clients from supplying the routing-expression (restrict or disable the routing functionality) and limit network exposure of affected services. Review application logs for unexpected SpEL payloads in routing-expressions and check affected hosts for indicators of compromise, including ransomware staging.

CVE-2022-22965 ('Spring4Shell') is a critical (CVSS 9.8) remote code execution flaw in VMware's Spring Framework, caused by insecure data binding that lets unauthenticated attackers overwrite internal class and module properties through crafted request parameters (CWE-94, code injection). It affects Spring MVC and Spring WebFlux applications running on JDK 9 or later; the demonstrated exploit path requires a Tomcat WAR deployment, while applications packaged as Spring Boot executable jars are not exploitable that way, though the underlying issue may be reachable via other routes. A successful attack yields full remote code execution with the privileges of the application server, with no authentication or user interaction required. VMware Spring Framework 5.3.0-5.3.17 and 5.2.0-5.2.19 (plus older releases) are affected, and the flaw also impacts bundled products from Cisco, Oracle, Siemens and Veritas, including multiple Oracle Communications Cloud Native Core components. It is being actively exploited in the wild: added to CISA's KEV on 2022-04-04, EPSS puts 30-day exploitation probability at 99.6% (100th percentile), a public PoC is available, and mass scanning of vulnerable servers has been observed.

Do: Upgrade Spring Framework to 5.3.18, 5.2.20 or later (or apply vendor-supplied fixes for bundled products, e.g., via Oracle's patch release and Cisco's advisory), prioritizing internet-facing Tomcat WAR deployments on JDK 9+; this is a CISA KEV entry, so treat patching as urgent. If patching must wait, mitigate by running on JDK 8, deploying as a Spring Boot executable jar rather than a WAR on Tomcat, and applying the vendor-documented workaround that disallows 'class.*', 'Class.*' and 'module.*' fields in data binding. Inventory exposed Tomcat/Spring services and hunt for signs of exploitation given confirmed in-the-wild use.