Impact of CVE-2022-22965 and CVE-2022-22963 on Service Virtualization

Products

• Service Virtualization
• CA Application Test

Issue/Introduction

 

Two vulnerabilities CVE-2022-22965 and CVE-2022-22963 have been reported on Spring Framework. 

 

CVE-2022-22965: Spring Framework RCE via Data Binding on JDK 9+

 A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

These are the prerequisites for the exploit:

• JDK 9 or higher
• Apache Tomcat as the Servlet container
• Packaged as WAR
• spring-webmvc or spring-webflux dependency

 

CVE-2022-22963: Remote code execution in Spring Cloud Function by malicious Spring Expression

 In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

 

What is the impact on Service Virtualization / DevTest?

 

Environment

DevTest 10.6.x, 10.7.x

Cause

Vulnerability

Resolution

Our engineering team has analyzed these vulnerabilities and confirmed that Service Virtualization / DevTest is not impacted by these vulnerabilities as we are not running our applications on JDK9+ and are not using Spring Cloud Function libraries.

CVE-2022-22965:
Service Virtualization is NOT vulnerable to this zero-day exploit as it ships JRE8 and doesn’t use Tomcat as the servlet container.

CVE-2022-22963:
Service Virtualization doesn’t ship Spring Cloud Function library and is NOT vulnerable to this exploit.