Actively exploited · Published Mar 3, 2022 · Assigned by vmware
CVE-2022-22947
Critical 10.0 Exploited
In plain English
A critical-severity code injection in Spring Cloud Gateway. Attackers are actively exploiting it in the wild (listed by CISA on May 16, 2022). The chance it is exploited in the next 30 days is estimated at 98.3% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jun 6, 2022.
Official description
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.cloud:spring-cloud-gateway | 3.0.7 | GHSA-3gx9-37ww-9qw6 |
| Maven | org.springframework.cloud:spring-cloud-gateway | 3.1.1 | GHSA-3gx9-37ww-9qw6 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Spring Cloud Gateway | Spring cloud gateway versions 3.1.x prior to 3.1.1+, 3.0.x prior to 3.0.7+ and all old and unsupported versions |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://tanzu.vmware.com/security/cve-2022-22947
- https://www.oracle.com/security-alerts/cpuapr2022.html
- http://packetstormsecurity.com/files/166219/Spring-Cloud-Gateway-3.1.0-Remote-Code-Execution.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- http://packetstormsecurity.com/files/168742/Spring-Cloud-Gateway-3.1.0-Remote-Code-Execution.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22947 government-resource