Spring Cloud Gateway 3.1.0 Remote Code Execution

Exploit Title: Spring Cloud Gateway 3.1.0 - Remote Code Execution RCE Google Dork: N/A Date: 03/03/2022 Exploit Author: Carlos E. Vieira Vendor Homepage: https://spring.io/ Software Link: https://spring.io/projects/spring-cloud-gateway Version: This vulnerability affect Spring Cloud Gateway 3.0.7...

Spring Cloud Gateway 3.1.0 - Remote Code Execution Exploit

Exploit Title: Spring Cloud Gateway 3.1.0 - Remote Code Execution RCE Exploit Author: Carlos E. Vieira Vendor Homepage: https://spring.io/ Software Link: https://spring.io/projects/spring-cloud-gateway Version: This vulnerability affect Spring Cloud Gateway 3.0.7 & 3.1.1 Tested on: 3.1.0 CVE :...

CVE-2022-22946

In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be configured to use an insecure TrustManager. This makes the gateway able to connect to remote services with invalid or custom certificates...

Code injection

In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be configured to use an insecure TrustManager. This makes the gateway able to connect to remote services with invalid or custom certificates...

CVE-2022-22946

CVE-2022-22946 affects Spring Cloud Gateway versions prior to 3.1.1+. When HTTP/2 is enabled and there is no key store or trusted certificates, the gateway may be configured to use an insecure TrustManager, allowing connections to remote services with invalid or custom certificates. Affected comp...

CVE-2022-22946

In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be configured to use an insecure TrustManager. This makes the gateway able to connect to remote services with invalid or custom certificates...

CVE-2022-22946

In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be configured to use an insecure TrustManager. This makes the gateway able to connect to remote services with invalid or custom certificates...

CVE-2022-22946

In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be configured to use an insecure TrustManager. This makes the gateway able to connect to remote services with invalid or custom certificates...

Exploit for Code Injection in Vmware Spring_Cloud_Gateway

CVE-2022-22947-RcePOC Batch URL detection for Spring-Clou...

Exploit for Expression Language Injection in Vmware Spring_Cloud_Gateway

CVE-2022-22947-RcePOC Batch URL detection for Spring-Clou...

Exploit for Code Injection in Vmware Spring_Cloud_Gateway

CVE-2022-22947 Poc for CVE-2022-22947 DnsLog When I w...

Exploit for Code Injection in Vmware Spring_Cloud_Gateway

Spring Cloud Gateway RCE Env CVE-2022-22947 CVE-2022-2294...

Exploit for Code Injection in Vmware Spring_Cloud_Gateway

-cve-2022-22947- cve-2022-22947 Spring Cloud Gateway Batc...

Exploit for Code Injection in Vmware Spring_Cloud_Gateway

Spring Cloud Gateway Remote Code Execution Vulnerability...

Exploit for Code Injection in Vmware Spring_Cloud_Gateway

Spring-Cloud-Gateway CVE-2022-22947 Spring Cloud Gatewa...

Exploit for Code Injection in Vmware Spring_Cloud_Gateway

Spring-Cloud-Gateway CVE-2022-22947 Spring Cloud Gatewa...

Spring Cloud Gateway vulnerable to Code Injection when Gateway Actuator endpoint enabled, exposed, unsecured

In Spring Cloud Gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed, and unsecured. A remote attacker could make a maliciously crafted request resulting in arbitrary remote execution on the...

GHSA-3GX9-37WW-9QW6 Spring Cloud Gateway vulnerable to Code Injection when Gateway Actuator endpoint enabled, exposed, unsecured

In Spring Cloud Gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed, and unsecured. A remote attacker could make a maliciously crafted request resulting in arbitrary remote execution on the...

CVE-2022-22946: Improper Certificate Validation

In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be configured to use an insecure TrustManager. This makes the gateway able to connect to remote services with invalid or custom certificates...

Code injection

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the...