CVE-2022-22947criticalunder attackCWE-94

CVE-2022-22947: critical vulnerability in Spring Cloud Gateway

Published · Updated

Follow this CVE+ Monitor Cloud Gateway+ Monitor Spring Cloud Gateway

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 10epss 98%
from disclosure to weaponsame day
Published on NVDMar 3
1st PoCJan 25
metasploitJan 26
CISA KEV+74d
Action required by CISAfederal deadline: 2022-06-06

Apply updates per vendor instructions.

In short

Spring Cloud Gateway allows attackers to execute arbitrary code on the server if the Actuator endpoint is exposed without proper security. This happens through a specially crafted request that exploits code injection vulnerabilities.

Technical detail

CWE-94 code injection vulnerability in Spring Cloud Gateway Actuator endpoint allows remote code execution when the endpoint is exposed without authentication. Pre-condition: Actuator must be enabled and publicly accessible. Attack vector involves sending malicious payloads through the Actuator interface, resulting in arbitrary command execution on the host.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
n/a · Spring Cloud Gateway
public PoCs found — 119
exploitdbwww.exploit-db.com/exploits/50799unverifiedgithubgithub.com/lucksec/Spring-Cloud-Gateway-CVE-2022-22947★ 221githubgithub.com/whwlsfb/cve-2022-22947-godzilla-memshell★ 210githubgithub.com/SecNN/CVE-2022-22947_Rce_Exp★ 77githubgithub.com/tangxiaofeng7/CVE-2022-22947-Spring-Cloud-Gateway★ 72githubgithub.com/0730Nophone/CVE-2022-22947-★ 59githubgithub.com/crowsec-edtech/CVE-2022-22947★ 37githubgithub.com/0x7eTeam/CVE-2022-22947★ 34githubgithub.com/Zh0um1/CVE-2022-22947★ 27githubgithub.com/Tas9er/SpringCloudGatewayRCE★ 27githubgithub.com/Enokiy/cve-2022-22947-spring-cloud-gateway★ 18githubgithub.com/viemsr/spring_cloud_gateway_memshell★ 18githubgithub.com/B0rn2d/Spring-Cloud-Gateway-Nacos★ 16githubgithub.com/MoCh3n/CVE-2022-22947-Spring-Cloud-Gateway-SpelRCE★ 14githubgithub.com/4nNns/CVE-2022-22947★ 12githubgithub.com/k3rwin/spring-cloud-gateway-rce★ 12githubgithub.com/Wrin9/CVE-2022-22947★ 11githubgithub.com/Vulnmachines/spring-cve-2022-22947★ 11githubgithub.com/twseptian/cve-2022-22947★ 11githubgithub.com/SiJiDo/CVE-2022-22947★ 9githubgithub.com/dingxiao77/-cve-2022-22947-★ 9githubgithub.com/hunzi0/CVE-2022-22947-Rce_POC★ 7githubgithub.com/anansec/CVE-2022-22947_EXP★ 7githubgithub.com/mrknow001/CVE-2022-22947★ 7githubgithub.com/darkb1rd/cve-2022-22947★ 6githubgithub.com/YutuSec/SpEL★ 6githubgithub.com/Greetdawn/CVE-2022-22947★ 5githubgithub.com/Arrnitage/CVE-2022-22947_exp★ 5githubgithub.com/sagaryadav8742/springcloudRCE★ 4githubgithub.com/LY613313/CVE-2022-22947★ 3githubgithub.com/stayfoolish777/CVE-2022-22947-POC★ 3githubgithub.com/nu0l/cve-2022-22947★ 3githubgithub.com/22ke/CVE-2022-22947★ 2githubgithub.com/dbgee/CVE-2022-22947★ 2githubgithub.com/Vancomycin-g/CVE-2022-22947★ 2githubgithub.com/Le1a/CVE-2022-22947★ 2githubgithub.com/kkx600/Burp_VulPscan★ 2githubgithub.com/Nathaniel1025/CVE-2022-22947★ 1githubgithub.com/kmahyyg/CVE-2022-22947★ 1githubgithub.com/talentsec/Spring-Cloud-Gateway-CVE-2022-22947★ 1githubgithub.com/Jun-5heng/CVE-2022-22947★ 1githubgithub.com/bysinks/CVE-2022-22947★ 1githubgithub.com/Wrong-pixel/CVE-2022-22947-exp★ 1githubgithub.com/qq87234770/CVE-2022-22947★ 1githubgithub.com/shoucheng3/spring-cloud__spring-cloud-gateway_CVE-2022-22947_3-0-6★ 0githubgithub.com/Sumitpathania03/CVE-2022-22947★ 0githubgithub.com/scopion/cve-2022-22947★ 0githubgithub.com/SanderSchepers1993/CyberSec2026★ 0githubgithub.com/CyberCTF/vulhub-spring-cve-2022-22947★ 0githubgithub.com/flying0er/CVE-2022-22947-goby★ 0githubgithub.com/nanaao/CVE-2022-22947-POC★ 0githubgithub.com/scopion/CVE-2022-22947-exp★ 0githubgithub.com/superneilcn/SpringExploitGUI★ 0githubgithub.com/cc3305/CVE-2022-22947★ 0githubgithub.com/ciri3/spring-cloud-gateway-cve-2022-22947-report★ 0githubgithub.com/entr0pie/demo-cve-2022-22947★ 0githubgithub.com/BerMalBerIst/CVE-2022-22947★ 0githubgithub.com/PaoPaoLong-lab/Spring-CVE-2022-22947-★ 0githubgithub.com/hh-hunter/cve-2022-22947-docker★ 0githubgithub.com/fbion/CVE-2022-22947★ 0githubgithub.com/aesm1p/CVE-2022-22947-POC-Reproduce★ 0githubgithub.com/Summer177/Spring-Cloud-Gateway-CVE-2022-22947★ 0githubgithub.com/skysliently/CVE-2022-22947-pb-ai★ 0cve_referencepacketstormsecurity.com/files/168742/Spring-Cloud-Gateway-3.1.0-Remote-Code-Execution.htmlunverifiedvulncheckvulncheck.com/xdb/b1f298b6352aunverifiedvulncheckvulncheck.com/xdb/7bf61e3db187unverifiedvulncheckvulncheck.com/xdb/769ad48809b9unverifiedvulncheckvulncheck.com/xdb/fd72b929a3aeunverifiedvulncheckvulncheck.com/xdb/0751146bcae7unverifiedvulncheckvulncheck.com/xdb/7bc2856e5f63unverifiedvulncheckvulncheck.com/xdb/66245b597db0unverifiedvulncheckvulncheck.com/xdb/32e3404666d2unverifiedvulncheckvulncheck.com/xdb/ee5d2b5c3f92unverifiedvulncheckvulncheck.com/xdb/a02abe0b70a0unverifiedvulncheckvulncheck.com/xdb/6eeb91b260d2unverifiedvulncheckvulncheck.com/xdb/d03fdfb98036unverifiedvulncheckvulncheck.com/xdb/a48d3f6ecc63unverifiedvulncheckvulncheck.com/xdb/e709c7824d6funverifiedvulncheckvulncheck.com/xdb/0e346534d99cunverifiedvulncheckvulncheck.com/xdb/ef11176b296dunverifiedvulncheckvulncheck.com/xdb/3e6c0320c020unverifiedvulncheckvulncheck.com/xdb/2665970cc7d0unverifiedvulncheckvulncheck.com/xdb/497a7868a7f8unverifiedvulncheckvulncheck.com/xdb/9344fae60775unverifiedvulncheckvulncheck.com/xdb/e911b1c2597funverifiedvulncheckvulncheck.com/xdb/06a474d9b7ecunverifiedvulncheckvulncheck.com/xdb/e7ca8c762802unverifiedvulncheckvulncheck.com/xdb/afa67d1ce366unverifiedvulncheckvulncheck.com/xdb/bd2a06bbd8bbunverifiedvulncheckvulncheck.com/xdb/1c0791ff43d4unverifiedvulncheckvulncheck.com/xdb/48f7a107c7f1unverifiedvulncheckvulncheck.com/xdb/e697218879acunverifiedvulncheckvulncheck.com/xdb/7599adf41434unverifiedvulncheckvulncheck.com/xdb/ee88d373e895unverifiedvulncheckvulncheck.com/xdb/7c4707de67d0unverifiedvulncheckvulncheck.com/xdb/52d243c6aa1dunverifiedvulncheckvulncheck.com/xdb/dfd01d1df0cdunverifiedvulncheckvulncheck.com/xdb/a2acec081752unverifiedvulncheckvulncheck.com/xdb/363f053126bfunverifiedvulncheckvulncheck.com/xdb/91c0f9af0cacunverifiedvulncheckvulncheck.com/xdb/e02a7daadefdunverifiedvulncheckvulncheck.com/xdb/36b62abf2361unverifiedvulncheckvulncheck.com/xdb/d3e76959310aunverifiedvulncheckvulncheck.com/xdb/72664413dcfaunverifiedvulncheckvulncheck.com/xdb/27539aa6c18dunverifiedvulncheckvulncheck.com/xdb/9f8ecee41cb2unverifiedvulncheckvulncheck.com/xdb/befe5bc2b98funverifiedvulncheckvulncheck.com/xdb/2d4c78ac94faunverifiedvulncheckvulncheck.com/xdb/8386925a2e04unverifiedvulncheckvulncheck.com/xdb/6fbc84e7f7c7unverifiedvulncheckvulncheck.com/xdb/1740ab048871unverifiedvulncheckvulncheck.com/xdb/f1e2ed51e2a9unverifiedvulncheckvulncheck.com/xdb/ef9e824eaf8funverifiedvulncheckvulncheck.com/xdb/3290d808ee36unverifiedvulncheckvulncheck.com/xdb/81a8282f1ea5unverifiedvulncheckvulncheck.com/xdb/fee11cd0237cunverifiedvulncheckvulncheck.com/xdb/3faa58c1474cunverifiedvulncheckvulncheck.com/xdb/ad10528f5ebfunverifiedcve_referencepacketstormsecurity.com/files/166219/Spring-Cloud-Gateway-3.1.0-Remote-Code-Execution.htmlunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.