CVE-2022-22947
About
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
Rainforest analyst review
Spring Cloud Gateway exposes an Actuator endpoint that, when enabled and left unsecured, accepts route definitions containing SpEL expressions. An attacker sends a crafted POST that adds a route whose filter carries a malicious expression, then triggers a refresh so the gateway evaluates it. Because the Spring Expression Language runs with the full power of the JVM, that evaluation becomes arbitrary code execution on the host, no authentication required. The scope-change rating reflects that the injected expression can reach well beyond the gateway process itself.
Spring Cloud Gateway sits at the front of microservice architectures, routing and filtering traffic for everything behind it, so a foothold there is a foothold on the internal edge of the application. The Actuator endpoints are meant for operators, not the internet, but they are routinely left exposed by default configurations and permissive network rules. This one landed on CISA's KEV list because it was mass-scanned and exploited soon after disclosure. Upgrade to 3.1.1+ or 3.0.7+, and if you cannot patch immediately, disable the Gateway Actuator or lock it down so it is not reachable from untrusted networks.
References
- http://packetstormsecurity.com/files/166219/Spring-Cloud-Gateway-3.1.0-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/168742/Spring-Cloud-Gateway-3.1.0-Remote-Code-Execution.html
- https://tanzu.vmware.com/security/cve-2022-22947
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22947
Related CVEs
Frequently asked questions
What is CVE-2022-22947?
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
How severe is CVE-2022-22947?
CVE-2022-22947 carries a CVSS 3.1 base score of 10, rated critical. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 100 out of 100, in the critical band.
How is CVE-2022-22947 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H): attack vector Network, attack complexity Low, privileges required None, user interaction None. Impact on confidentiality High, integrity High and availability High.
Which products are affected by CVE-2022-22947?
Public advisories list the following as affected: commerce guided search, communications cloud native core binding support function, communications cloud native core console, communications cloud native core network exposure function, communications cloud native core network function cloud native environment, communications cloud native core network repository function, +4. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2022-22947?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.