漏洞描述
Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions are susceptible to remote code execution vulnerabilities. When using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
github.comhttps://github.com/spring-cloud/spring-cloud-function/commit/0e89ee27b2e76138c16bcba6f4bca906c4f3744f↗github.comhttps://github.com/cckuailong/spring-cloud-function-SpEL-RCE↗tanzu.vmware.comhttps://tanzu.vmware.com/security/cve-2022-22963↗nsfocusglobal.comhttps://nsfocusglobal.com/spring-cloud-function-spel-expression-injection-vulnerability-alert/↗github.comhttps://github.com/vulhub/vulhub/tree/scf-spel/spring/spring-cloud-function-spel-injection↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2022-22963↗