CVE-2022-22947: Code Injection in Spring Cloud Gateway
Summary
CVE-2022-22947: In Spring Cloud Gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed, and unsecured. Affects org.springframework.cloud:spring-cloud-gateway across 2 version ranges.
< 3.0.7
>= 3.1.0, < 3.1.1
Fixed in 3.0.7 or 3.1.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Cloud Gateway is a popular open-source project that provides a way to route requests to backend services based on various criteria. It acts as an API gateway, allowing developers to build scalable and secure microservices architectures. However, versions prior to 3.1.1+ and 3.0.7+ are vulnerable to a critical code injection attack when the Gateway Actuator endpoint is enabled, exposed, and unsecured. This vulnerability can be exploited by a remote attacker to execute arbitrary code on the target host.
Vulnerability Detail
The vulnerability arises due to improper input validation in the Gateway Actuator endpoint. By sending a specially crafted request, an attacker can inject malicious code into the application, leading to arbitrary remote code execution. This can have severe consequences, including unauthorized access, data breaches, and complete compromise of the affected system. The Common Vulnerabilities and Exposures (CVE) identifier for this vulnerability is CVE-2022-22947. The vulnerability has a CVSS score of 10.0, indicating its criticality.
How To Fix
Latest published version: 5.1.0-RC1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.0.73.0.7 -
>= 3.1.0, < 3.1.13.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the fixed versions is not immediately feasible, a temporary workaround is to disable or secure the Gateway Actuator endpoint. This can be achieved by configuring proper access controls and authentication mechanisms to restrict unauthorized access to the Actuator endpoint. Consult the Spring Cloud Gateway documentation for guidance on securing the Actuator endpoint.
Conclusion
In conclusion, the Spring Cloud Gateway vulnerability (CVE-2022-22947) exposes applications to a critical code injection attack when the Gateway Actuator endpoint is enabled, exposed, and unsecured. To mitigate this vulnerability, it is crucial to upgrade to the fixed versions and properly secure the Actuator endpoint. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework.cloud:spring-cloud-gateway →
FAQ
Spring Cloud Gateway is an open-source project that provides a way to route requests to backend services based on various criteria. It acts as an API gateway, enabling developers to build scalable and secure microservices architectures.
The vulnerability allows a remote attacker to execute arbitrary code on the target host by exploiting the Gateway Actuator endpoint. This can lead to unauthorized access, data breaches, and complete compromise of the affected system.
To fix this vulnerability, upgrade to Spring Cloud Gateway version 3.1.1+ or 3.0.7+. Ensure that the Gateway Actuator endpoint is properly secured and not exposed to untrusted networks.
If immediate upgrade is not feasible, you can secure or disable the Gateway Actuator endpoint by configuring proper access controls and authentication mechanisms.
The CVSS score of this vulnerability is 10.0, indicating its criticality.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.cloud:spring-cloud-gateway.
