CVE-2022-22965: Spring Framework JDK 9+ Remote Code Execution Vulnerability

CVE-2022-22965 is a remote code execution vulnerability in the VMware Spring Framework. Spring MVC or Spring WebFlux applications running on JDK 9 or later may be vulnerable to RCE via data binding. This matters because successful abuse can let an unauthenticated or lightly authenticated attacker run code in the application process, which often leads to full host compromise, lateral movement, and data theft. Confirm exact affected configurations and fixed releases against the vendor advisory.

How it works

The weakness is classified as CWE-94 (improper control of code generation, or code injection). In Spring MVC or Spring WebFlux applications, data binding maps incoming request parameters or body fields onto Java objects. On JDK 9 and later, certain binding paths can be abused so that attacker-controlled input influences class loading or property resolution in a way that results in arbitrary code execution inside the JVM. An attacker typically sends crafted HTTP requests that target the data-binding surface; if the application accepts the payload and the runtime conditions are met, the framework executes attacker-supplied logic with the privileges of the application process. Exact exploit mechanics and preconditions must be confirmed against the vendor advisory; do not rely on incomplete public descriptions.

Am I affected? How to find it in your systems

Spring Framework is widely used in Java enterprise and cloud-native services. It commonly appears as a transitive dependency in web applications, microservices, API gateways, and internal tools that use Spring MVC or Spring WebFlux.

• Inventory: search build manifests (Maven pom.xml, Gradle build files), dependency lock files, and container images for Spring Framework artifacts. Check both direct and transitive dependencies.
• Runtime: identify Java processes running on JDK 9 or newer that load Spring MVC or WebFlux components. Review application server and container configurations for Spring-based apps.
• Version and configuration checks: compare your Spring Framework versions and JDK level against the vendor advisory. Pay special attention to applications that perform data binding on untrusted input (form posts, query parameters, JSON/XML payloads).
• Telemetry: look for anomalous HTTP requests with unusual parameter names or nested property paths, unexpected class-loading or reflection activity, sudden outbound connections from application hosts, or process creation spawned by the Java runtime. Correlate web access logs with application and host logs.

If you cannot confirm the precise component versions in use, treat internet-facing Spring MVC/WebFlux applications on JDK 9+ as potentially exposed until verified.

How to remediate

Patch first. Apply the updates published by the vendor for the Spring Framework exactly as described in the official advisory. CISA’s required action is to apply updates per vendor instructions. After upgrading, rebuild and redeploy affected applications, then verify the new dependency versions are active in production.

• Re-scan dependency trees and container images to confirm the vulnerable components are gone.
• Harden data binding: restrict which properties can be bound, avoid binding directly from untrusted input onto complex objects, and use allow-lists where the framework supports them.
• Run applications with least privilege, keep the JDK and supporting libraries current, and disable unnecessary Spring features that enlarge the attack surface.
• Add or tighten input validation and output encoding as defense-in-depth for this code-injection class.

If you can't patch immediately

Implement compensating controls while you schedule the upgrade:

• Network segmentation and access control: limit who can reach the vulnerable application; place it behind strong authentication and restrict source IPs where feasible.
• Virtual patching / WAF: deploy rules that detect and block request patterns associated with data-binding abuse for this class of flaw. Tune to reduce false positives and monitor for bypass attempts.
• Feature reduction: temporarily disable or tightly constrain data-binding endpoints that accept complex object graphs from untrusted clients, if the business can tolerate it.
• Heightened monitoring: alert on suspicious parameter patterns, unexpected JVM child processes, unusual class loading, and post-exploitation behaviors (new scheduled tasks, credential access, lateral connections). Retain relevant logs for incident response.
• Compensating host controls: enforce strict egress filtering and application allow-listing on the hosts running the Spring applications.

These measures reduce risk but do not replace the vendor patch. Confirm any temporary configuration changes against the advisory so you do not break required functionality or leave residual exposure.

If your data may have been exposed

Actively exploited RCE vulnerabilities frequently precede broader intrusion and data theft. If you have evidence of exploitation or cannot rule it out, follow your incident-response process: isolate affected systems, preserve logs and memory images, rotate credentials and secrets that the application could access, and assess what data the compromised process could reach. Known ransomware use is not documented for this CVE. As a further check, you can run a free exposure scan of your email addresses against known breach data to see whether associated credentials or personal information have appeared in prior incidents.