CVE-2022-22947: VMware Spring Cloud Gateway Code Injection Vulnerability
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
Other sources
In Spring Cloud Gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed, and unsecured. A remote attacker could make a maliciously crafted request resulting in arbitrary remote execution on the remote host.
Spring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.springframework.cloud:spring-cloud-gatewayto a version that resolves this vulnerability.Fixed in 3.1.1 - Upgrade
Upgrade
maven/org.springframework.cloud:spring-cloud-gatewayto a version that resolves this vulnerability.Fixed in 3.0.7 - Configuration
If the Gateway Actuator endpoint is not required, disable the Gateway Actuator endpoint so it is not enabled or exposed.
Spring Cloud Gateway (Gateway Actuator endpoint) Gateway Actuator endpoint = disabled - Compensating control
If the Gateway Actuator endpoint must remain enabled, restrict access so it is not exposed to untrusted networks — require authentication/authorization and limit access via firewall/ACLs/WAF to trusted IPs or management networks only.
Event History
Frequently Asked Questions
What is CVE-2022-22947?
CVE-2022-22947 is a code injection vulnerability in VMware Spring Cloud Gateway, allowing arbitrary remote execution.
What is affected by CVE-2022-22947?
Spring Cloud Gateway versions prior to 3.1.1+ and 3.0.7+ are affected by CVE-2022-22947, as well as certain Oracle products.
How severe is CVE-2022-22947?
CVE-2022-22947 is classified as critical and has a severity score of 10.
How do I fix CVE-2022-22947?
To fix CVE-2022-22947, upgrade to Spring Cloud Gateway version 3.1.1+ or 3.0.7+. Apply the provided fix for affected Oracle products.
Where can I find more information about CVE-2022-22947?
You can find more information about CVE-2022-22947 at the NIST National Vulnerability Database (NVD) and VMware Security Advisory pages.