In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuat
Affects Spring Cloud Gateway 3.1.0 and 3.0.6 and earlier, only when the Gateway Actuator endpoint is enabled, exposed and unsecured. Fixed in 3.1.1 and 3.0.7.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 3.0.7, 3.1.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Spring Cloud Gateway, a Java-based API gateway framework, is affected when its Gateway Actuator endpoint is enabled, exposed, and not secured. A remote attacker who sends a specially crafted request could inject code and execute arbitrary commands on the affected host.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- n/a Spring Cloud Gateway
Spring cloud gateway versions 3.1.x prior to 3.1.1+, 3.0.x prior to 3.0.7+ and all old and unsupported versions
- org.springframework.cloud:spring-cloud-gatewayMaven
fixed in 3.0.7
- org.springframework.cloud:spring-cloud-gatewayMaven
From 3.1.0 · fixed in 3.1.1
References 5
Questions about CVE-2022-22947
What does this mean?
A code injection flaw in Spring Cloud Gateway can allow arbitrary remote execution on the host. The flaw lies in the Gateway Actuator endpoint.Source: spring.io
Am I affected, and how do I check?
Spring Cloud Gateway 3.1.0 and 3.0.6 and earlier are affected, and only when the Gateway Actuator endpoint is enabled, exposed and unsecured. To check a setup, look at whether management.endpoint.gateway.enabled is true and whether the gateway actuator endpoint can be reached without security.Source: spring.io
What should I do about it?
Upgrade to 3.1.1 on the 3.1 line or 3.0.7 on the 3.0 line. If upgrading is not possible, disable the Gateway actuator endpoint with management.endpoint.gateway.enabled: false.Source: spring.io
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-05-16, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data