spring-cve-2022-22947

spring-cve-2022-22947 Spring cloud gateway code injection : CVE-2022-22947...

CVE-2022-22963

CVE-2022-22963 In versions 3.1.6, 3.2.2, and earlier versions of Spring Cloud Function, when using the routing functionality, it is possible for a user to provide a specially crafted SpEL as a routing expression that can result in remote code execution and access to local resources. PoC Clone the...

SpringCloudGatewayRCE

SpringCloudGateway Remote Command Execution Vulnerability Code By: Tas9er 0x00 Risk Overview This tool is intended for authorized security testing only. Unauthorized attacks on systems are prohibited. 0x01 Tool Usage java -jar SpringCloudGatewayRCE.jar 0x02 Bug Issues Will address later...

SpEL

SpEL Batch detection tool for Spring Cloud Gateway Actuator API SpEL expression injection command execution CVE-2022-22947 Usage Write the URLs to be tested line by line in a file. Use parameter -TF to specify the file, and -t for concurrency count. Execution Result Yutu Security is committed to...

cve-2022-22947

cve-2022-22947 Spring Cloud Gateway is an API gateway in Spring. Versions 3.1.0 and 3.0.6 inclusive and earlier contain a SpEL expression injection vulnerability. When an attacker can access the Actuator API, they can exploit this vulnerability to execute arbitrary commands. Usage: root@kitploit:...

SpringExploitGUI

SpringExploitGUIv1.0 0x01 Preface Today, I reproduced several previous Spring vulnerabilities and weaponized them. The tool currently supports detection and exploitation of Spring Cloud Gateway RCE CVE-2022-22947, Spring Cloud Function SpEL RCE CVE-2022-22963, and Spring Framework RCE...

cve-2022-22947

Spring Cloud Gateway Actuator API SpEL Code Injection CVE-2022-22947 Build root@kitploit: $ git clone https://github.com/twseptian/cve-2022-22947.git $ cd cve-2022-22947 $ docker build . -t cve-2022-22947 $ docker run -p 9000:9000 --name cve-2022-22947 cve-2022-22947 PoC send the following reques...

Spring-Cloud-Gateway-CVE-2022-22947

Spring-Cloud-GatewayCVE-2022-22947 Spring Cloud Gateway Remote Code Execution Vulnerability root@kitploit: python3 springrce.py url cmd There is a cache, execute it several times...

CVE-2022-22947

CVE-2022-22947 Spring Cloud Gateway is an API gateway in Spring. Versions 3.1.0 and 3.0.6 inclusive and earlier have a SpEL expression injection vulnerability. If an attacker can access the Actuator API, they can exploit this vulnerability to execute arbitrary commands. Vulnerability Environment...

EUVD-2026-77093

A security flaw has been discovered in wxiaoqi Spring-Cloud-Platform 1.0/2.2/3.0. This issue affects the function OnlineController.getOnlineInfo of the file aceModules/ace-admin/auth/controller/OnlineController.java. The manipulation results in missing authorization. The attack can be executed...

CVE-2026-90595

CVE-2026-90595 is a missing authorization flaw in wxiaoqi Spring-Cloud-Platform versions 1.0, 2.2, and 3.0. The vulnerability resides in the OnlineController.getOnlineInfo function within aceModules/ace-admin/auth/controller/OnlineController.java. A remote attacker with low privileges can exploit...

CVE-2026-90594

A missing authorization (fail-open) vulnerability in the Permission Service of wxiaoqi Spring-Cloud-Platform versions 3.0.1 and 3.1.0 affects the function PermissionService.checkUserPermission in /rpc/service/PermissionService.java. The flaw allows remote attackers with low privileges to bypass p...

EUVD-2026-77092

A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0. This vulnerability affects the function PermissionService.checkUserPermission of the file /rpc/service/PermissionService.java of the component Permission Service. The manipulation leads to missing authorization. Remote...

spring4shell-scan

spring4shell-scan A fully automated, reliable, and accurate scanner for finding Spring4Shell and Spring Cloud RCE vulnerabilities Features Support for lists of URLs. Fuzzing for more than 10 new Spring4Shell payloads previously seen tools uses only 1-2 variants. Fuzzing for HTTP GET and POST...

spring-cloud-gateway-rce

Spring Cloud Gateway Actuator API SpEL Expression Injection Command Execution CVE-2022-22947 1. Installation root@kitploit: pip3 install -r requirements.txt 2. Usage root@kitploit: $ python3 spring-cloud-gateway-rce.py -h / \ /\ /\ /\ | \ / \ | \ | \ | \ | \ / \ | || | | | / / \ \ / / /\ || | | |...

CVE-2022-22963_Reverse-Shell-Exploit

CVE-2022-22963 Reverse Shell Exploit This is a Python script that exploits CVE-2022-22963, a remote code execution vulnerability in Spring Cloud Function that allows attackers to execute arbitrary code on a vulnerable server. The exploit uses the vulnerable /functionRouter endpoint to execute a...

CVE-2022-22947

Copied from Original: https://github.com/whwlsfb/cve-2022-22947-godzilla-memshell https://github.com/lucksec/Spring-Cloud-Gateway-CVE-2022-22947...

CVE-2022-22947_EXP

1. Spring Cloud Gateway Remote Code Execution Vulnerability Hazard Level: High POC/EXP: Public CNVD ID: CNNVD-2022-16402 CVE ID: CVE-2022-22947 2. Affected Versions: VMWare Spring Cloud GateWay 3.1.0 VMWare Spring Cloud GateWay =3.0.0, =3.0.6 VMWare Spring Cloud GateWay 3.0.0 3. Vulnerability...

spring-cloud__spring-cloud-gateway_CVE-2022-22947_3-0-6

//// DO NOT EDIT THIS FILE. IT WAS GENERATED. Manual changes to this file will be lost when it is generated again. Edit the files in the src/main/asciidoc/ directory instead. //// image::https://circleci.com/gh/spring-cloud/spring-cloud-gateway/tree/master.svg?style=svg"CircleCI",...

spring-cloud-function-rce

Spring Cloud Function SPEL Expression Injection Vulnerability CVE-2022-22963 Spring framework provides a comprehensive programming and configuration model for modern Java-based enterprise applications on any type of deployment platform. The serverless framework in Spring Cloud, the RoutingFunctio...