Spring-Cloud-Gateway-CVE-2022-22947

Security advisory for a remote code execution vulnerability in Spring Cloud Gateway. When Spring Cloud Gateway is enabled and the Gateway Actuator endpoint is exposed, applications using Spring Cloud Gateway are susceptible to code injection attacks. An attacker can send specially crafted malicious requests to remotely execute arbitrary code.

Affected Versions

• Spring Cloud Gateway < 3.1.1
• Spring Cloud Gateway < 3.0.7
• Older, unsupported versions of Spring Cloud Gateway are also affected

Patched Versions

• Spring Cloud Gateway >= 3.1.1
• Spring Cloud Gateway >= 3.0.7

Spring Cloud Gateway is an API gateway built on Spring Framework and Spring Boot, designed to provide a simple, effective, and unified way to route API requests in a microservice architecture.

Remediation Recommendations

Temporary Mitigation:

If the gateway actuator endpoint is not required, disable it by setting management.endpoint.gateway.enabled: false. If the actuator is needed, secure it using Spring Security. See: https://docs.spring.io/spring-boot/docs/current/reference/html/actuator.html#actuator.endpoints.security

General Fix:

The vendor has released patched versions. Please update as soon as possible. Download: https://github.com/spring-cloud/spring-cloud-gateway

Attack via URL