CVE-2022-22963

9.8

CVSS
Critical

PUBLISHED

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to...

Exploited in the wild Remote Low complexity No user interaction

Vendor: VMware
Product: Spring Cloud Function
Published: Apr 01, 2022
EPSS: —

Description

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

java cisa nuclei_scanner metasploit

CVSS scores

CVSS v3.1 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 7.5

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitation status

Exploited in the wild

Recorded 2022-08-25 00:00:00 UTC · Source

SSVC decision points

Exploitation: active
Automatable: Yes
Technical impact: total

References

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source	Added
CISA	Aug 25, 2022

Scanner integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/spring_cloud_function_spel_injection.rb	Apr 28, 2025
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22963.yaml	Apr 25, 2025

Potential proof of concepts

These PoCs are unverified and could contain malware. Use at your own risk.

spring_cloud_function_spel_injection

metasploit · Created Unknown

Metasploit module for CVE-2022-22963

randallbanner/Spring-Cloud-Function-Vulnerability-CVE-2022-22963-RCE

github · Created 2023-04-17 13:54:06 UTC · 4 stars

J0ey17/CVE-2022-22963_Reverse-Shell-Exploit

github · Created 2023-03-18 11:43:00 UTC · 22 stars

CVE-2022-22963 is a vulnerability in the Spring Cloud Function Framework for Java that allows remote code execution. This python script will verify if the vulnerability exists, and if it does, will give you a reverse shell.

lemmyz4n3771/CVE-2022-22963-PoC

github · Created 2023-03-13 13:28:55 UTC · 4 stars

CVE-2022-22963 RCE PoC in python

charis3306/CVE-2022-22963

github · Created 2023-03-07 15:57:29 UTC · 8 stars

spring cloud function 一键利用工具! by charis 博客https://charis3306.top/

iliass-dahman/CVE-2022-22963-POC

github · Created 2023-01-15 21:39:20 UTC · 4 stars

me2nuk/CVE-2022-22963

github · Created 2022-03-31 14:32:14 UTC · 17 stars

Spring Cloud Function Vulnerable Application / CVE-2022-22963

Kirill89/CVE-2022-22963-PoC