VMware Spring Cloud Gateway Remote Code Execution (CVE-2022-22947)

CVE-2022-22947 is a remote code execution (RCE) vulnerability in Spring Cloud Gateway. The vulnerability allows unauthenticated attackers to inject malicious Spring Expression Language (SpEL) expressions via the Actuator endpoint when creating dynamic routes. When the application refreshes its configuration, the injected expression is evaluated, resulting in arbitrary code execution on the underlying server.

Attack Chain

1. Attacker identifies an exposed and unprotected Actuator endpoint on the target Spring Cloud Gateway instance.
2. Attacker sends a POST request to /actuator/gateway/routes/{route_name} containing a JSON payload with a malicious SpEL expression in the filter arguments.
3. Attacker sends a POST request to /actuator/gateway/refresh to trigger the application to load the new route configuration.
4. Attacker sends an HTTP request matching the path defined in the newly created malicious route.
5. The Gateway evaluates the injected SpEL expression during route processing.
6. Arbitrary commands are executed by the application process with the privileges of the service user.

Impact

The vulnerability has a CVSS 3.1 score of 10.0 (Critical). Successful exploitation leads to full system compromise, allowing for remote code execution, unauthorized data access, and disruption of service.

Recommendation

• Upgrade VMware Spring Cloud Gateway to version 3.1.1 or 3.0.7 or later.
• Disable the Actuator endpoint if it is not required for operational monitoring.
• If the Actuator endpoint is required, restrict network access using firewall rules or implement mandatory authentication via Spring Security to prevent unauthorized access.
• Audit existing gateway route configurations for unexpected or malicious entries.