Description
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Spring Cloud Gateway | Spring cloud gateway versions 3.1.x prior to 3.1.1+, 3.0.x prior to 3.0.7+ and all old and unsupported versions | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Spring Cloud Gateway Remote Code Execution
exploit/linux/http/spring_cloud_gateway_rce
Exploit-DB 1
- Spring Cloud Gateway 3.1.0 - Remote Code Execution (RCE) EDB-50799 · webapps · Mar 7, 2022
GitHub 62 repositories · most starred shown
-
lucksec/Spring-Cloud-Gateway-CVE-2022-22947 ★ 221 · Mar 2, 2022
CVE-2022-22947
-
whwlsfb/cve-2022-22947-godzilla-memshell ★ 210 · Apr 26, 2022
CVE-2022-22947 注入Godzilla内存马
-
SecNN/CVE-2022-22947_Rce_Exp ★ 77 · Mar 3, 2022
Spring Cloud Gateway 远程代码执行漏洞Exp Spring_Cloud_Gateway_RCE_Exp-CVE-2022-22947
-
tangxiaofeng7/CVE-2022-22947-Spring-Cloud-Gateway ★ 72 · Mar 4, 2022
CVE-2022-22947批量
-
0730Nophone/CVE-2022-22947- ★ 59 · May 16, 2022
Spring Cloud Gateway Actuator API SpEL表达式注入命令执行（CVE-2022-22947） 注入哥斯拉内存马
-
crowsec-edtech/CVE-2022-22947 ★ 37 · Mar 3, 2022
Spring Cloud Gateway < 3.0.7 & < 3.1.1 Code Injection (RCE)
-
0x7eTeam/CVE-2022-22947 ★ 34 · Mar 8, 2022
CVE-2022-22947_EXP,CVE-2022-22947_RCE,CVE-2022-22947反弹shell,CVE-2022-22947 getshell
-
Zh0um1/CVE-2022-22947 ★ 27 · Feb 7, 2023
CVE-2022-22947注入哥斯拉内存马
-
Tas9er/SpringCloudGatewayRCE ★ 27 · Mar 3, 2022
SpringCloudGatewayRCE - CVE-2022-22947 / Code By:Tas9er
-
viemsr/spring_cloud_gateway_memshell ★ 18 · Mar 18, 2022
CVE-2022-22947 memshell
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Spring Cloud Gateway Code Injection http/cves/2022/CVE-2022-22947.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.springframework.cloud:spring-cloud-gateway | < 3.0.7 | 3.0.7 | GHSA-3gx9-37ww-9qw6 |
| Maven | org.springframework.cloud:spring-cloud-gateway | >= 3.1.0, < 3.1.1 | 3.1.1 | GHSA-3gx9-37ww-9qw6 |
References
- https://tanzu.vmware.com/security/cve-2022-22947
- https://www.oracle.com/security-alerts/cpuapr2022.html
- http://packetstormsecurity.com/files/166219/Spring-Cloud-Gateway-3.1.0-Remote-Code-Execution.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- http://packetstormsecurity.com/files/168742/Spring-Cloud-Gateway-3.1.0-Remote-Code-Execution.html