SpringCloudGatewayRCE

SpringCloudGateway Remote Command Execution Vulnerability Code By: Tas9er 0x00 Risk Overview This tool is intended for authorized security testing only. Unauthorized attacks on systems are prohibited. 0x01 Tool Usage java -jar SpringCloudGatewayRCE.jar 0x02 Bug Issues Will address later...

cve-2022-22947

Spring Cloud Gateway Actuator API SpEL Code Injection CVE-2022-22947 Build $ git clone https://github.com/twseptian/cve-2022-22947.git $ cd cve-2022-22947 $ docker build . -t cve-2022-22947 $ docker run -p 9000:9000 --name cve-2022-22947 cve-2022-22947 PoC send the following request to add a rout...

spring-cloud-gateway-rce

Spring Cloud Gateway Actuator API SpEL Expression Injection Command Execution CVE-2022-22947 1. Installation pip3 install -r requirements.txt 2. Usage $ python3 spring-cloud-gateway-rce.py -h / \ /\ /\ /\ | \ / \ | \ | \ | \ | \ / \ | || | | | / / \ \ / / /\ || | | | | | | || || || | / / / / \ V...

cve-2022-22947

cve-2022-22947 Spring Cloud Gateway is an API gateway in Spring. Versions 3.1.0 and 3.0.6 inclusive and earlier contain a SpEL expression injection vulnerability. When an attacker can access the Actuator API, they can exploit this vulnerability to execute arbitrary commands. Usage: ➜...

Spring-Cloud-Gateway-Nacos

This repository does not have a README...

CVE-2022-22947

Spring Cloud Gateway Actuator API SpEL Expression Injection Command Execution CVE-2022-22947 Spring Cloud Gateway Actuator API SpEL Code Injection CVE-2022-22947 Usage: -t http://vuldomain.com // single IP -f urls.txt // read file for batch scan, multi-threaded, fast -c command // custom command,...

spring_cloud_gateway_memshell

CVE-2022-22947 memshell This script is incomplete, for learning purposes only, do not use illegally. Based on c0ny1 senior's blog, this is a learning script that can write netty and spring memory shells. Test environment is vulhub eg:xx.py http://127.0.0.1:8080 netty whoami...

CVE-2022-22947-

CVE-2022-22947 Spring Cloud Gateway Actuator API SpEL expression injection command execution（CVE-2022-22947） Inject Godzilla memory shell Default key pass base64 Note: the code does not clear the route part, please clear it yourself.. Test environment:...

CVE-2022-22947-Spring-Cloud-Gateway-SpelRCE

CVE-2022-22947-Spring-Cloud-Gateway-SpelRCE CVE-2022-22947 Introduction Hazard Level: High POC/EXP Status: Public CNVD ID: CNNVD-2022-16402 Affected Versions: Spring Cloud Gateway 3.1.0 Spring Cloud Gateway =3.0.0, =3.0.6 Spring Cloud Gateway 3.0.0 Vulnerability Description Spring Cloud Gateway h...

CVE-2022-22947_Rce_Exp

CVE-2022-22947RceExp Spring Cloud Gateway Remote Code Execution Vulnerability Exp SpringCloudGatewayRCEExp-CVE-2022-22947...

CVE-2022-22947

CVE-2022-22947 script for exploit Spring Cloud Gateway Actuator API SpEL Code Injection CVE-2022-22947 https://github.com/march0s1as/CVE-2022-22947 cd CVE-2022-22947 go build spring.go ./spring -h...

Spring Cloud Gateway Server Webflux - Broken Access Control

Spring Cloud Gateway Server Webflux contains a vulnerability caused by unsecured and exposed actuator endpoints allowing modification of Spring Environment properties, letting attackers modify configuration, exploit requires unsecured actuator endpoints exposure. id: CVE-2025-41243 info: name:...

CVE-2022-22947

CVE-2022-22947 Run: CVE-2022-22947.exe ip command Affected versions: Spring Cloud Gateway 3.1.1 Spring Cloud Gateway 3.0.7 Spring Cloud Gateway other no longer updated versions...

CVE-2022-22947

Copied from Original: https://github.com/whwlsfb/cve-2022-22947-godzilla-memshell https://github.com/lucksec/Spring-Cloud-Gateway-CVE-2022-22947...

SpringExploitGUI

SpringExploitGUIv1.0 0x01 Preface Today, I reproduced several previous Spring vulnerabilities and weaponized them. The tool currently supports detection and exploitation of Spring Cloud Gateway RCE CVE-2022-22947, Spring Cloud Function SpEL RCE CVE-2022-22963, and Spring Framework RCE...

CVE-2022-22947

Spring Cloud Gateway RCE Env CVE-2022-22947 CVE-2022-22947 was identified in the Spring Cloud Gateway Server jar. After the application is compiled you should be able to view the existing routes by visiting: http://127.0.0.1:9000/actuator/gateway/routes Compile $ mvn package -DskipTests Run $ jav...

CVE-2022-22947-POC

Spring-Cloud-Gateway-CVE-2022-22947 Security advisory for a remote code execution vulnerability in Spring Cloud Gateway. When Spring Cloud Gateway is enabled and the Gateway Actuator endpoint is exposed, applications using Spring Cloud Gateway are susceptible to code injection attacks. An attacke...

spring-cloud__spring-cloud-gateway_CVE-2022-22947_3-0-6

//// DO NOT EDIT THIS FILE. IT WAS GENERATED. Manual changes to this file will be lost when it is generated again. Edit the files in the src/main/asciidoc/ directory instead. //// image::https://circleci.com/gh/spring-cloud/spring-cloud-gateway/tree/master.svg?style=svg"CircleCI",...

CVE-2022-22947

CVE-2022-22947 Spring Cloud Gateway is an API gateway in Spring. Versions 3.1.0 and 3.0.6 inclusive and earlier have a SpEL expression injection vulnerability. If an attacker can access the Actuator API, they can exploit this vulnerability to execute arbitrary commands. Vulnerability Environment...

CVE-2022-22947-pb-ai

CVE-2022-22947 Spring Cloud Gateway Vulnerability Verification Application This is a Spring Cloud Gateway application specifically designed to demonstrate and verify the CVE-2022-22947 vulnerability. The application uses a vulnerable version of Spring Cloud Gateway and allows arbitrary code...