Spring Cloud Function SpEL Injection

aka Spring Cloud Function RCE

Product: VMware / Spring Spring Cloud Function
CVE: CVE-2022-22963
Disclosed: 2022-03-29
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: 3.1.6, 3.2.2 and older unsupported versions
Fixed: 3.1.7, 3.2.3

Summary

Spring Cloud Function's routing feature evaluates a Spring Expression Language (SpEL) expression taken directly from an HTTP header. Any app exposing the functionRouter endpoint can be made to execute arbitrary commands with one request.

Root cause

RoutingFunction reads the spring.cloud.function.routing-expression header and evaluates it with a StandardEvaluationContext, which permits type references such as T(java.lang.Runtime). The header value was not restricted to a SimpleEvaluationContext until the fix.

Impact

Unauthenticated RCE in any Spring Cloud Function application with routing enabled.

Public PoC

POST /functionRouter HTTP/1.1
Host: localhost:8080
spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec("touch /tmp/success")
Content-Type: text/plain
Content-Length: 4

test

Source: vulhub / spring/CVE-2022-22963

Detection

Alert on requests containing a 'spring.cloud.function.routing-expression' header, especially with 'T(' or 'Runtime'. nuclei template CVE-2022-22963.

Mitigation

Upgrade to 3.1.7 / 3.2.3+; strip the routing-expression header at the edge if upgrade is delayed.