Description

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

Affected Spring Products and Versions

• Spring Cloud Function
  • 3.1.6
  • 3.2.2
  • Older, unsupported versions are also affected

Mitigation

Users of affected versions should upgrade to 3.1.7, 3.2.3. No other steps are necessary. Releases that have fixed this issue include:

• Spring Cloud Function
  • 3.1.7
  • 3.2.3

Credit

This vulnerability was initially discovered and responsibly reported by m09u3r.

References

• https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• https://cwe.mitre.org/data/definitions/770.html
• https://cwe.mitre.org/data/definitions/497.html

History

• 2022-03-29: Initial vulnerability report published.
• 2022-03-31: Updates to description, severity and references.