A recently revealed vulnerability in some versions of <\/span>Spring Cloud<\/span><\/a>, a component of the Spring framework for Java used as a component of cloud and web applications, is now being exploited by attackers to remotely execute code on servers running the framework.<\/span>\u00a0<\/span><\/p>\n \u00a0<\/span>The vulnerability, CVE-2022-22963<\/span><\/a>, was announced on March 29 \u2014 along with a <\/span>corresponding updated release<\/span><\/a> of the framework.\u00a0 The disclosure comes on the heels of <\/span>another remote code execution vulnerability (CVE-2022-22947) in Spring Cloud Gateway,<\/span><\/a> patched earlier in March. As <\/span>Sophos\u2019 Paul Ducklin reported<\/span><\/a>, there are already proof-of-concept exploits for the new vulnerability (CVE-2022-22963) publicly available.\u00a0<\/span>\u00a0<\/span><\/p>\n The exploit uses crafted web requests based on the Spring Expression Language (SpEL) to inject Java code as part of Spring Cloud Function requests. The proof-of-concept versions of the exploit demonstrate how to use the exploit to run malicious software remotely on the Spring Cloud server.<\/span>\u00a0<\/span><\/p>\n Anyone using affected versions of Spring Cloud Function should <\/span>upgrade<\/span><\/a> to 3.1.7, 3.2.3.<\/span>\u00a0<\/span><\/p>\n SophosLabs has released an IPS signature (XG: 2306<\/strong><\/span>9<\/strong>89<\/strong>) for endpoint and firewall devices (ID) to detect and block this vulnerability. We continue to investigate other claimed exploits of Spring Core, and will update this report as more details become available.<\/span>\u00a0<\/span><\/p>\n<\/p><\/div>\n
![](\"https:\/\/news.sophos.com\/wp-content\/uploads\/2022\/03\/coffee-rain-luckakcul-image.jpg\"\/)
<\/p>\n