Outbreak Alert: VMware Spring Cloud Function RCE Vulnerability

This article describes the VMware Spring Cloud Function remote code execution vulnerability assessment with FortiDAST.

CVE-2022-22963 vulnerability was discovered in VMware Spring Cloud Function. Spring Framework is an open source lightweight Java-based platform application development framework for creating high-performing, easily testable code. And, Spring Cloud provides developer tools to build distributed systems (e.g. configuration management, service discovery, etc).

By crafting a malicious expression an attacker can execute remote code execution and get local resource access to the target.

FortiDAST version 23.2

Detection against that vulnerability is empowered by the FortiDAST Scripting Engine (FSE).

This technology enables FortiDAST to assess remotely with high level of confidence if an asset is vulnerable to a specific vulnerability by testing the disarmed exploit against the asset itself.

To configure the scan, you will need to enable the FSE group signature “spring-framework” which will select the underlying script:

'CVE-2022-22963 Spring Cloud Function 3.1.6, 3.2.2 and older Remote Code Execution Vulnerability'

For reference, a step-by-step guide on how to configure FortiDAST to trigger FSE can be found on Fortinet’s blog.

For more details regarding mitigating the vulnerability by utilizing Fortinet products, refer to https://www.fortiguard.com/outbreak-alert/vmware-spring-cloud-function