Spring-Cloud-Gateway-CVE-2022-22947

Security advisory for the remote code execution vulnerability in Spring Cloud Gateway. This vulnerability occurs when the Gateway Actuator endpoint is enabled and exposed in Spring Cloud Gateway, making applications using Spring Cloud Gateway susceptible to code injection attacks. An attacker can send specially crafted malicious requests to remotely execute arbitrary code.

【Affected Versions】

Spring Cloud Gateway < 3.1.1 Spring Cloud Gateway < 3.0.7 Older, unsupported versions of Spring Cloud Gateway are also affected 【Fixed Versions】

Spring Cloud Gateway >= 3.1.1 Spring Cloud Gateway >= 3.0.7

Spring Cloud Gateway is an API gateway built on Spring Framework and Spring Boot, designed to provide a simple, effective, and unified API routing management method for microservice architectures.

Remediation Recommendations Temporary Remediation:

If the Gateway actuator endpoints are not needed, disable them by setting management.endpoint.gateway.enabled: false. If the actuator is needed, secure it using Spring Security—see https://docs.spring.io/spring-boot/docs/current/reference/html/actuator.html#actuator.endpoints.security.

General Remediation:

The official security patch has been released. Please download and update in time. Download link: https://github.com/spring-cloud/spring-cloud-gateway

Attacking via URL

Run with python3

python3

The information provided on this website is for reference purposes only