CVE-2022-22965

Name of the Vulnerable Software and Affected Versions Spring Framework versions prior to 5.2.20 Spring Framework versions prior to 5.3.18 Spring Boot versions prior to 2.5.12 Spring Boot versions prior to 2.6.6 VMware Tanzu Application Service for Virtual Machines versions 2.10 through 2.13 VMware Tanzu Operations Manager versions 2.8 through 2.9 VMware Tanzu Kubernetes Grid Integrated Edition versions 1.11 through 1.13

Description A remote code execution (RCE) issue exists in Spring MVC and Spring WebFlux applications running on JDK 9+ via data binding. By crafting requests that manipulate object properties through the data-binding mechanism to reach ClassLoader-related fields, an attacker can write a malicious file, such as a JSP web shell, and execute arbitrary code. This flaw is remotely exploitable without privileges or user interaction. The specific exploit path requires the application to be deployed as a WAR on Apache Tomcat; applications deployed as Spring Boot executable jars in the default configuration are not affected, although the underlying weakness is more general. It is estimated that millions of installations may be potentially affected, with some reports indicating up to 600,000 vulnerable devices. Real-world incidents involving malicious HTTP POST requests have been detected.

Recommendations Update Spring Framework to version 5.3.18 or 5.2.20. Update Spring Boot to version 2.6.6 or 2.5.12. As a temporary workaround, set disallowedFields on WebDataBinder through an @ControllerAdvice. To apply the workaround more securely, extend RequestMappingHandlerAdapter to update the WebDataBinder after all other initialization by declaring a WebMvcRegistrations bean (for Spring MVC) or a WebFluxRegistrations bean (for Spring WebFlux).