CVE-2022-22965: Remote Code Execution in Spring Framework

CVE-2022-22965 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2022-03-31

A remote code execution vulnerability exists in Spring MVC and Spring WebFlux applications running on JDK 9+ due to improper data binding. Exploitation typically requires the application to be deployed as a WAR on Apache Tomcat, though the underlying vulnerability is more general. This flaw allows an unauthenticated attacker to execute arbitrary code on the host.

Technologies: org.springframework:spring-webflux (Maven), org.springframework:spring-webmvc (Maven), VMware Spring Framework. Vendors: Maven, VMware.

Quick answers

Is CVE-2022-22965 exploited in the wild?
Yes. CVE-2022-22965 is known to be exploited in the wild, first recorded on 4 April 2022. Treat it as urgent.
How severe is CVE-2022-22965?
Critical severity, with a CVSS score of 3.1, published 31 March 2022.
Which products and versions are affected?
org.springframework:spring-beans (Maven) ECOSYSTEM:introduced=0,fixed=5.2.20.RELEASE; org.springframework:spring-webflux (Maven) ECOSYSTEM:introduced=0,fixed=5.2.20.RELEASE; org.springframework:spring-webmvc (Maven) ECOSYSTEM:introduced=0,fixed=5.2.20.RELEASE; org.springframework.boot:spring-boot-starter-web (Maven) ECOSYSTEM:introduced=0,fixed=2.5.12; and 1 more.
Is there a fix for CVE-2022-22965?
Yes. org.springframework:spring-beans (Maven): upgrade to 5.2.20.RELEASE or later; org.springframework:spring-webflux (Maven): upgrade to 5.2.20.RELEASE or later; org.springframework:spring-webmvc (Maven): upgrade to 5.2.20.RELEASE or later; org.springframework.boot:spring-boot-starter-web (Maven): upgrade to 2.5.12 or later; org.springframework.boot:spring-boot-starter-webflux (Maven): upgrade to 2.5.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-22965 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2022-22965?
Check whether you run org.springframework:spring-beans (Maven), org.springframework:spring-webflux (Maven), org.springframework:spring-webmvc (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.springframework:spring-beans (Maven): upgrade to 5.2.20.RELEASE or later
    # set org.springframework:spring-beans to 5.2.20.RELEASE in your pom.xml or build.gradle
  • org.springframework:spring-webflux (Maven): upgrade to 5.2.20.RELEASE or later
    # set org.springframework:spring-webflux to 5.2.20.RELEASE in your pom.xml or build.gradle
  • org.springframework:spring-webmvc (Maven): upgrade to 5.2.20.RELEASE or later
    # set org.springframework:spring-webmvc to 5.2.20.RELEASE in your pom.xml or build.gradle
  • org.springframework.boot:spring-boot-starter-web (Maven): upgrade to 2.5.12 or later
    # set org.springframework.boot:spring-boot-starter-web to 2.5.12 in your pom.xml or build.gradle
  • org.springframework.boot:spring-boot-starter-webflux (Maven): upgrade to 2.5.12 or later
    # set org.springframework.boot:spring-boot-starter-webflux to 2.5.12 in your pom.xml or build.gradle

Affected products

  • VMware Spring Framework < 5.2.20, 5.3.0 to < 5.3.18
  • Oracle JDK >= 9

Identifiers

  • CVE-2022-22965
  • GHSA-36p3-wjmg-h94x

Timeline

  • 2022-04-04: disclosed
  • 2022-04-04: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
  • 2022-04-04: advisory: NVD publication date

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.