CVE-2022-22979

Overview

Spring Cloud Function is a framework that enables developers to build functional, serverless-style applications using Spring. It provides a Function Catalog that allows functions to be dynamically looked up and invoked at runtime.

A Denial of Service vulnerability (CVE-2022-22979) has been identified in Spring Cloud Function. This issue can allow an attacker to exhaust system resources and make an application unavailable by abusing the framework’s function lookup mechanism.

This vulnerability is associated with CWE-770 Allocation of Resources Without Limits or Throttling, where a system does not properly restrict resource consumption, allowing uncontrolled growth.

Denial of Service occurs when a system becomes unavailable due to resource exhaustion or excessive processing. In this case, improper handling of cached function lookups may allow unbounded resource consumption.

This issue affects multiple versions of Spring Cloud Function.

‍

Details

Module Info

• Product: spring-cloud-function
• Affected packages: spring-cloud-function
• Affected versions: <3.2.6
• GitHub repository: https://github.com/spring-cloud/spring-cloud-function/
• Published packages: https://central.sonatype.com/artifact/org.springframework.cloud/spring-cloud-function-context
• Package manager: Maven
• Fixed In: NES for Spring Cloud Function v3.1.8

‍

Vulnerability Info

This flaw affects Spring Cloud Function applications that expose or allow interaction with the framework’s function lookup functionality, particularly through the spring-cloud-function-web module.

The vulnerability is caused by a caching issue in the Function Catalog component. In affected versions, repeated lookup requests can create new cache entries without sufficient limits or eviction controls. An attacker who can invoke the lookup functionality can exploit this behavior to grow the cache indefinitely, leading to excessive memory consumption and eventual service disruption. Also, it is possible for an attacker to invoke functions that were not intended to be exposed, since there is no mechanism to mark beans as ineligible for cloud function invocation.

Under these conditions, an attacker may be able to:

• Trigger unbounded growth of the internal function cache
• Exhaust application memory or resources
• Cause the application to become unresponsive or crash

‍

Steps To Reproduce

1. Use an application with an affected Spring Cloud Function version that includes the spring-cloud-function-web module.
2. Identify the function lookup endpoint, typically accessible at /functionRoute or through specific routing-expression headers.
3. Submit high-frequency HTTP requests with crafted function definitions containing delimiter characters (e.g., , or | or |)that bypass existing cache checks.
4. Observe resource exhaustion (CPU or Memory) leading to a denial-of-service condition where the application becomes unresponsive or crashes.

‍

Mitigation

Only recent versions of Spring Cloud Function are community-supported. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Restrict Access to Lookup Endpoints (such as /functionRoute) to trusted internal networks or authenticated users only.
• Implement Rate Limiting at the API gateway or application level to prevent high-frequency requests that exploit resource allocation weaknesses.
• Upgrade affected applications to supported versions of Spring Cloud Function
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credits

• Yaniv.Nizry@checkmarx.com