Exploit for #VU60982 Code Injection in Spring Cloud Gateway

Vulnerability identifier: #VU60982

Vulnerability risk: High

CVSSv4.0: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber]

CVE-ID: CVE-2022-22947

CWE-ID: CWE-94

Exploitation vector: Network

Exploits in database: 56

• June 21, 2024
  • CVE-2022-22947 (CVE-2022-22947 exploit script) [Github]
• June 8, 2023
  • CVE-2022-22947-Spring-Cloud-Gateway-SpelRCE (Spring Cloud Gateway远程代码执行漏洞POC，基于命令执行的基础上，增加了反弹shell操作) [Github]
• June 3, 2023
  • CVE-2022-22947 (Spring Cloud Gateway Actuator API SpEL表达式注入命令执行Exp) [Github]
• May 11, 2023
  • CVE-2022-22947 (CVE-2022-22947注入哥斯拉内存马) [Github]
• February 1, 2023
  • CVE-2022-22947-Rce_POC (批量url检测Spring-Cloud-Gateway-CVE-2022-22947) [Github]
• November 15, 2022
  • CVE-2022-22947 () [Github]
• November 14, 2022
  • Burp_VulPscan (burp被动扫描插件，目前只有CVE-2022-22947) [Github]
• October 23, 2022
  • CVE-2022-22947 () [Github]
• October 12, 2022
  • Spring Cloud Gateway Remote Code Execution [Metasploit]
• August 23, 2022
  • CVE-2022-22947 () [Github]
• August 3, 2022
  • CVE-2022-22947 () [Github]
• July 24, 2022
  • CVE-2022-22947_exp (CVE-2022-22947 Exploit script) [Github]
• June 9, 2022
  • CVE-2022-22947-POC (批量检测Spring Cloud Gateway 远程代码执行漏洞 Spring_Cloud_Gateway_RCE_POC-CVE-2022-22947) [Github]
  • CVE-2022-22947-POC (批量检测Spring Cloud Gateway 远程代码执行漏洞 Spring_Cloud_Gateway_RCE_POC-CVE-2022-22947) [Github]
• May 29, 2022
  • CVE-2022-22947-exp () [Github]
• May 19, 2022
  • CVE-2022-22947_EXP (一个可单独、批量验证的脚本，也可以反弹shell) [Github]
• May 17, 2022
  • CVE-2022-22947- (Spring Cloud Gateway Actuator API SpEL表达式注入命令执行（CVE-2022-22947） 注入哥斯拉内存马) [Github]
• May 13, 2022
  • Spring Cloud Gateway 3.1.0 - Remote Code Execution (RCE) [Exploit-DB]
• April 26, 2022
  • cve-2022-22947-godzilla-memshell (CVE-2022-22947 注入Godzilla内存马) [Github]
• April 15, 2022
  • CVE-2022-22947-exp () [Github]
• April 1, 2022
  • springcloudRCE (Spring Cloud Gateway RCE - CVE-2022-22947 ) [Github]
• March 30, 2022
  • CVE-2022-22947-exp () [Github]
  • CVE-2022-22947 () [Github]
• March 27, 2022
  • CVE-2022-22947 (Spring Cloud Gateway < 3.0.7 & < 3.1.1 Code Injection (RCE)) [Github]
  • CVE-2022-22947 (poc for CVE-2022-22947) [Github]
• March 20, 2022
  • spring_cloud_gateway_memshell (CVE-2022-22947 memshell) [Github]
• March 17, 2022
  • CVE-2022-22947 (CVE-2022-22947_POC_EXP) [Github]
• March 14, 2022
  • spring-cloud-gateway-rce (spring-cloud-gateway-rce CVE-2022-22947) [Github]
• March 10, 2022
  • Spring-CVE-2022-22947- () [Github]
  • CVE-2022-22947-Spring-Cloud () [Github]
  • CVE-2022-22947-exp (CVE-2022-22947 Exploit script) [Github]
• March 8, 2022
  • CVE-2022-22947 (CVE-2022-22947_EXP,CVE-2022-22947_RCE,CVE-2022-22947反弹shell,CVE-2022-22947 getshell) [Github]
• March 7, 2022
  • CVE-2022-22947-Spring-Cloud-Gateway-SpelRCE (Spring Cloud Gateway远程代码执行漏洞POC，基于命令执行的基础上，增加了反弹shell操作) [Github]
  • CVE-2022-22947 (SpringCloudGatewayRCE / Code By:Jun_sheng) [Github]
  • cve-2022-22947 () [Github]
  • CVE-2022-22947 (Spring Cloud Gateway Actuator API SpEL Code Injection (CVE-2022-22947)) [Github]
• March 5, 2022
  • cve-2022-22947 (poc for cve-2022-22947) [Github]
  • Spring-Cloud-Gateway-CVE-2022-22947 (Spring Cloud Gateway远程代码执行漏洞) [Github]
  • CVE-2022-22947 () [Github]
  • CVE-2022-22947 (Exp) [Github]
  • cve-2022-22947 (Spring-Cloud-Gateway-CVE-2022-22947) [Github]
  • -cve-2022-22947- ( cve-2022-22947 spring cloud gateway 批量扫描脚本) [Github]
  • CVE-2022-22947 (Spring Cloud Gateway Actuator API SpEL Code Injection.) [Github]
  • CVE-2022-22947-goby (日常更新一些顺手写的gobypoc，包含高危害EXP) [Github]
  • CVE-2022-22947-Spring-Cloud-Gateway (CVE-2022-22947批量) [Github]
  • CVE-2022-22947-POC (CVE-2022-22947批量检测脚本，超时时间不超过2s，已更新可反弹shell的EXP，欢迎师傅们试用) [Github]
  • CVE-2022-22947 () [Github]
  • CVE-2022-22947-Rce_POC (批量url检测Spring-Cloud-Gateway-CVE-2022-22947) [Github]
• March 3, 2022
  • CVE-2022-22947-RCE (CVE-2022-22947 RCE) [Github]
  • cve-2022-22947 (poc for cve-2022-22947) [Github]
  • CVE-2022-22947_Rce_Exp (Spring Cloud Gateway 远程代码执行漏洞Exp Spring_Cloud_Gateway_RCE_Exp-CVE-2022-22947) [Github]
  • Spring_CVE_2022_22947 (Spring_CVE_2022_22947:Spring Cloud Gateway现高风险漏洞cve,poc漏洞利用,一键利用,开箱即用) [Github]
  • spring-cve-2022-22947 (Spring cloud gateway code injection : CVE-2022-22947) [Github]
  • CVE-2022-22947 (Spring Cloud Gateway < 3.0.7 & < 3.1.1 Code Injection (RCE)) [Github]
  • SpringCloudGatewayRCE (SpringCloudGatewayRCE - CVE-2022-22947 / Code By:Tas9er) [Github]
  • Spring-Cloud-Gateway-CVE-2022-22947 (CVE-2022-22947) [Github]

Vulnerable software:
Spring Cloud Gateway
Server applications / Other server solutions

Vendor: VMware, Inc