漏洞描述
Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2022-22947↗wya.plhttps://wya.pl/2022/02/26/cve-2022-22947-spel-casting-and-evil-beans/↗github.comhttps://github.com/wdahlenburg/spring-gateway-demo↗spring.iohttps://spring.io/blog/2022/03/01/spring-cloud-gateway-cve-reports-published↗tanzu.vmware.comhttps://tanzu.vmware.com/security/cve-2022-22947↗