SpringCloudFunction-Research

SpringCloudFunction-Research CVE-2022-22963 research Environment vulfocus/spring-cloud-function-rce:latest Cause Parsing issue of the spring.cloud.function.routing-expression parameter in the Request Header, leading to injection Payload attacks. Reference...

CVE-2022-22963-Exploit

CVE-2022-22963 Exploit This repository contains a Rust-based exploit for the CVE-2022-22963 vulnerability found in Spring Cloud Function versions 3.1.6, 3.2.2, and older unsupported versions. The vulnerability allows remote code execution and access to local resources through a specially crafted...

CVE-2022-22963

Spring Cloud Function VulnerabilityCVE-2022-22963 Vulnerable Application to CVE-2022-22963 CVE-2022-22963 Exploit Demo https://user-images.githubusercontent.com/57348147/161266562-51d025f0-54d4-488f-ac50-2317e29bfbdf.mp4 Build docker pull me2nuk/cves:2022-22963 docker run -it -p 8080:8080...

CVE-2022-22963-PoC

CVE-2022-22963 RCE PoC Minimal example to reproduce CVE-2022-22963 remote code execution in org.springframework.cloud:spring-cloud-function-core. Exploit Run the server mvn spring-boot:run Make a request curl -X POST -H 'spring.cloud.function.routing-expression:...

spring-spel-0day-poc

spring-spel-0day-poc spring-cloud/spring-cloud-function RCE EXP POC https://github.com/spring-cloud/spring-cloud-function header spring.cloud.function.routing-expression:Tjava.lang.Runtime.getRuntime.exec"open -a calculator.app" build wget...

CVE-2026-92794 OpenSign through 2.41.3 Information Disclosure via getDocument

OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verification is disabled. Attackers can supply a document identifier from guest signing links to retrieve complete document details including all signers' information, sender identit...

CVE-2026-92794 OpenSign through 2.41.3 Information Disclosure via getDocument

OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verification is disabled. Attackers can supply a document identifier from guest signing links to retrieve complete document details including all signers' information, sender identit...

Improper Filtering Of HTTP Headers

Spring Cloud Function is vulnerable to improper filtering of HTTP headers. The vulnerability is due to insufficient validation and filtering of HTTP headers, which allows an attacker to send specially crafted HTTP requests containing malicious or unexpected headers and potentially influence...

Sensitive Data Exposure

org.springframework.cloud, spring-cloud-function-adapter-aws is vulnerable to sensitive data exposure. The vulnerability is due to sensitive information being included in application logs, which allows an attacker with access to the logs to obtain potentially confidential data...

Base Function Poisoning

Spring Cloud Function is vulnerable to base function poisoning. The vulnerability is due to improper handling of function composition lookup, which allows an attacker to manipulate or poison the base function and potentially execute unintended function compositions...

Sensitive Data Logging

Spring Cloud Function is vulnerable to Sensitive Data Logging. The vulnerability is due to insufficient redaction of sensitive information in its logging mechanisms, where request or response data may be written to logs without filtering and attackers can trigger the function with secret‑containi...

Scheme Verification Bypass

Spring Cloud Function is vulnerable to Scheme Verification Bypass. The vulnerability is due to the implementation of the isSecure method in ServerlessHttpServletRequest not verifying the actual scheme, where the method can report a request as secure even when the scheme is not HTTPS and an attack...

Server-Side Request Forgery (SSRF)

Spring Cloud Function is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of user-controlled file or resource paths, allowing an attacker to read arbitrary local files or make requests to attacker-controlled or internal resources...

CVE-2026-59300

Potential for logging sensitive data in Spring Cloud Function AWS. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier...

CVE-2026-59301

Potential for logging sensitive data in Spring Cloud Function Azure. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7...

CVE-2026-59298

Potential for improper filtering of HTTP headers in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier...

CVE-2026-59299

Composition lookup can potentially poison base function in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier...

CVE-2026-59297

Implementation of isSecure call of ServerlessHttpServletRequest does not verify the actual scheme. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7...

CVE-2026-59291

Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7...

CVE-2026-59300

Spring Cloud Function AWS is affected by a vulnerability where sensitive data may be logged . The issue affects versions 5.0.0–5.0.3 , 4.3.0–4.3.4 , 4.2.0–4.2.7 , and 3.2.16 and earlier . The CVSS 3.1 score is 3.1 (Low) , with a vector requiring network access, high attack complexity, high privil...