Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2022-22963

KEV EPSS 94.46% · P100
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2022-22963

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Spring Framework 代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Spring Framework是美国Spring团队的一套开源的Java、JavaEE应用程序框架。该框架可帮助开发人员构建高质量的应用。 Spring Framework 存在代码注入漏洞。目前暂无该漏洞信息，请随时关注CNNVD或厂商公告。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Shenlong Deep Dive — AI Deep Analysis

10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.

Read summary Full analysis (login)

Affected Products

VendorProductAffected VersionsCPESubscribe
-Spring Cloud Function Spring Cloud Function versions 3.1.6, 3.2.2 and all old and unsupported versions -

II. Public POCs for CVE-2022-22963

#POC DescriptionSource LinkShenlong Link
1spring-cloud / spring-cloud-function,spring.cloud.function.routing-expression,RCE,0day,0-day,POC,EXP,CVE-2022-22963https://github.com/hktalent/spring-spel-0day-pocPOC Details
2CVE-2022-22963 PoC https://github.com/dinosn/CVE-2022-22963POC Details
3CVE-2022-22963 Spring-Cloud-Function-SpEL_RCE_exploithttps://github.com/RanDengShiFu/CVE-2022-22963POC Details
4Nonehttps://github.com/darryk10/CVE-2022-22963POC Details
5Nonehttps://github.com/Kirill89/CVE-2022-22963-PoCPOC Details
6{ Spring Core 0day CVE-2022-22963 }https://github.com/stevemats/Spring0DayCoreExploitPOC Details
7Nonehttps://github.com/puckiestyle/CVE-2022-22963POC Details
8Spring Cloud Function Vulnerable Application / CVE-2022-22963https://github.com/me2nuk/CVE-2022-22963POC Details
9This includes CVE-2022-22963, a Spring SpEL / Expression Resource Access Vulnerability, as well as CVE-2022-22965, the spring-webmvc/spring-webflux RCE termed "SpringShell".https://github.com/kh4sh3i/Spring-CVEPOC Details
10POC for CVE-2022-22963https://github.com/AayushmanThapaMagar/CVE-2022-22963POC Details
11Spring Cloud Function SpEL - cve-2022-22963https://github.com/twseptian/cve-2022-22963POC Details
12CVE-2022-22963 researchhttps://github.com/SealPaPaPa/SpringCloudFunction-ResearchPOC Details
13Nonehttps://github.com/G01d3nW01f/CVE-2022-22963POC Details
14Spring Cloud Function SPEL表达式注入漏洞（CVE-2022-22963）https://github.com/k3rwin/spring-cloud-function-rcePOC Details
15Nonehttps://github.com/75ACOL/CVE-2022-22963POC Details
16Nonehttps://github.com/dr6817/CVE-2022-22963POC Details
17Nonehttps://github.com/iliass-dahman/CVE-2022-22963-POCPOC Details
18spring cloud function 一键利用工具! by charis 博客https://charis3306.top/https://github.com/charis3306/CVE-2022-22963POC Details
19CVE-2022-22963 RCE PoC in pythonhttps://github.com/lemmyz4n3771/CVE-2022-22963-PoCPOC Details
20CVE-2022-22963 is a vulnerability in the Spring Cloud Function Framework for Java that allows remote code execution. This python script will verify if the vulnerability exists, and if it does, will give you a reverse shell.https://github.com/J0ey17/CVE-2022-22963_Reverse-Shell-ExploitPOC Details
21Nonehttps://github.com/Mustafa1986/CVE-2022-22963POC Details
22Rust-based exploit for the CVE-2022-22963 vulnerabilityhttps://github.com/SourM1lk/CVE-2022-22963-ExploitPOC Details
23Nonehttps://github.com/randallbanner/Spring-Cloud-Function-Vulnerability-CVE-2022-22963-RCEPOC Details
24Binaries for CVE-2022-22963https://github.com/gunzf0x/CVE-2022-22963POC Details
25Exploit for CVE-2022-22963 remote command execution in Spring Cloud Functionhttps://github.com/nikn0laty/RCE-in-Spring-Cloud-CVE-2022-22963POC Details
26An exploit for the CVE-2022-22963 (Spring Cloud Function Vulnerability)https://github.com/HenriVlasic/Exploit-for-CVE-2022-22963POC Details
27This is a POC for CVE-2022-22963 https://github.com/BearClaw96/CVE-2022-22963-Poc-BearculesPOC Details
28CVE-2022-22963-pochttps://github.com/xmqaq/CVE-2022-22963POC Details
29Nonehttps://github.com/jrbH4CK/CVE-2022-22963POC Details
30An exploit for the CVE-2022-22963 (Spring Cloud Function Vulnerability)https://github.com/HenriV-V/Exploit-for-CVE-2022-22963POC Details
31CVE to CTF FPhttps://github.com/Shayz614/CVE-2022-22963POC Details
32Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions are susceptible to remote code execution vulnerabilities. When using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22963.yamlPOC Details
33Nonehttps://github.com/Threekiii/Awesome-POC/blob/master/%E5%BC%80%E5%8F%91%E6%A1%86%E6%9E%B6%E6%BC%8F%E6%B4%9E/Spring%20Cloud%20Function%20SpEL%E8%A1%A8%E8%BE%BE%E5%BC%8F%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5%20CVE-2022-22963.mdPOC Details
34https://github.com/vulhub/vulhub/blob/master/spring/CVE-2022-22963/README.mdPOC Details
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-22963

请登录查看更多情报信息。

Same Patch Batch · n/a · 2022-04-01 · 32 CVEs total

CVE-2022-250179.1 CRITICALHitron Technologies CHITA Router Firmware 操作系统命令注入漏洞
CVE-2022-212358.1 HIGHCommand Injection
CVE-2022-244408.1 HIGHCommand Injection
CVE-2022-212238.1 HIGHCommand Injection
CVE-2022-240668.1 HIGHCommand Injection
CVE-2022-22950Vmware Spring Framework 安全漏洞
CVE-2021-23247quick game engine 命令注入漏洞
CVE-2021-32503SICK FieldEcho 资源管理错误漏洞
CVE-2021-3461Red Hat Keycloak代码问题漏洞
CVE-2021-20295Red Hat Enterprise Linux 缓冲区错误漏洞
CVE-2021-27223Kaspersky Anti-Virus安全漏洞
CVE-2022-27534Kaspersky Anti-Virus 安全漏洞
CVE-2022-25155Mitsubishi Electric MELSEC iQ-F series 授权问题漏洞
CVE-2022-25156Mitsubishi Electric MELSEC iQ-F series 加密问题漏洞
CVE-2022-25157Mitsubishi Electric MELSEC iQ-F series 授权问题漏洞
CVE-2022-25159Mitsubishi Electric MELSEC iQ-F series 安全漏洞
CVE-2022-25158Mitsubishi Electric MELSEC iQ-F series 安全漏洞
CVE-2022-25160Mitsubishi Electric Factory Automation 安全漏洞
CVE-2022-22965Spring Framework 代码注入漏洞
CVE-2021-3847Linux kernel 安全漏洞

Showing top 20 of 32 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Spring Cloud Function
Same vendor: n/a
Same weakness: CWE-94

V. Comments for CVE-2022-22963

No comments yet

Leave a comment