VMware Spring Cloud Function

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

In Spring Cloud Function versions prior to 3.2.6, it is possible for a user who directly interacts with framework provided lookup functionality to cause a denial-of-service condition due to the caching issue in the Function Catalog component of the framework.

Self Routing guard bypassed via function composition

Unbounded cache for function definitions

Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function

Potential for logging sensitive data in Spring Cloud Function Azure

Potential for logging sensitive data in Spring Cloud Stream

Potential for improper filtering of HTTP headers in Spring Cloud Function

Composition lookup can potentially poison base function in Spring Cloud Function

Potential for logging sensitive data in Spring Cloud Function AWS

Spring Cloud Function can incorrectly determine if URI is secure