CVE-2022-22963: VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability

CVE-2022-22963 is a remote code execution vulnerability in VMware Tanzu Spring Cloud Function. When routing functionality is in use, an attacker can supply a specially crafted Spring Expression Language (SpEL) value as a routing-expression, which may allow execution of code and access to local resources on the affected system.

This matters because Spring Cloud Function is often used in cloud-native and microservice environments where untrusted input can reach routing logic. Successful abuse can give an attacker a foothold on the host or container running the function runtime. Confirm exact affected products and fixed releases against the vendor advisory.

How it works

The weakness is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). In products that evaluate expression languages such as SpEL for routing decisions, user-controlled input that is not strictly constrained can be interpreted as executable expression content rather than as inert data.

According to the CISA summary, when routing functionality in VMware Tanzu Spring Cloud Function is enabled, a user can provide a specially crafted SpEL routing-expression. That expression may be evaluated in a way that results in remote code execution and access to local resources. Public detail on exact request shape, headers, or payloads is limited here; treat any untrusted input that influences routing-expression evaluation as in scope and verify behavior against the vendor advisory and your own testing in a lab.

Am I affected? How to find it in your systems

VMware Tanzu Spring Cloud Function typically appears in Java-based microservice, serverless-style, or event-driven applications—often as a library or runtime component inside application servers, containers, or platform-as-a-service deployments that use Spring Cloud.

• Inventory application dependencies and images for Spring Cloud Function and related VMware Tanzu Spring Cloud components (build manifests, SBOM, Maven/Gradle lockfiles, container base layers).
• Identify services that expose or use function routing and that accept routing-expression (or equivalent) input from callers, gateways, or message headers.
• Compare deployed versions and configurations to the vendor advisory; only the advisory defines which builds are vulnerable and which are fixed.
• Review access paths: internet-facing APIs, internal service meshes, and message-driven entry points that can set routing metadata.
• For exploitation signs, inspect application and gateway logs for anomalous routing-expression values, unexpected SpEL-like syntax in request metadata, sudden process spawning, or unusual outbound connections from function runtimes. Specific IOCs are not provided in the given facts—tune detection to your environment and vendor guidance.

How to remediate

Patch first. Apply updates per vendor instructions, as required by CISA for this CVE. Replace vulnerable Spring Cloud Function components with the fixed builds named in the VMware Tanzu advisory and redeploy affected services.

• After upgrading, verify that routing no longer evaluates untrusted SpEL from user input in the dangerous way described, using vendor release notes and your regression tests.
• Harden expression handling for this class of flaw: avoid passing raw user input into SpEL or other expression engines; use allowlists for routing keys; disable or tightly restrict dynamic routing-expression features if you do not need them.
• Run applications with least privilege, read-only filesystems where possible, and segmented network identities so a single compromised function has limited blast radius.
• Rebuild and redeploy containers from known-good artifacts so old library versions do not remain in image layers.

If you can't patch immediately

Compensate until you can apply the vendor update:

• Segment and restrict access to any service that exposes Spring Cloud Function routing so only trusted callers can reach it.
• Disable routing-expression (or equivalent dynamic SpEL routing) features if your workloads do not require them.
• Apply virtual patching at a WAF or API gateway only if you can reliably identify and block the dangerous input patterns for this weakness—validate rules carefully so you do not rely on incomplete signatures alone.
• Increase monitoring on function hosts: alert on unexpected child processes, shell invocation, sensitive file access, and anomalous egress.
• Prefer temporary isolation or traffic shedding for high-risk internet-facing instances over prolonged exposure.

If your data may have been exposed

Actively exploited remote code execution flaws can lead to host compromise and data access; ransomware use is not documented for this CVE in the given facts. If you suspect exploitation, follow your incident response process: isolate affected workloads, preserve logs, rotate credentials that may have been reachable from the runtime, and assess what local resources the function identity could access. You can also run a free exposure scan of your email addresses against known breach data to see whether associated accounts appear in prior breaches while you complete containment and recovery.