## https://sploitus.com/exploit?id=EEA12A00-A397-5497-AFD6-3427AD52C0BF
# Spring-Cloud-Gateway-CVE-2022-22947
**Security Notice regarding the remote code execution vulnerability in Spring Cloud Gateway**. This vulnerability allows applications running Spring Cloud Gateway to be attacked via code injection attacks when the Gateway Actuator endpoint is enabled and exposed. Attackers can send specially crafted malicious requests to execute arbitrary code remotely. **Affected Versions**:
Spring Cloud Gateway = 3.1.1; Spring Cloud Gateway >= 3.0.7
Spring Cloud Gateway is an API gateway built using the Spring Framework and Spring Boot. It aims to provide a simple, efficient, and unified way of managing API routing for microservices architectures. **Fixing Recommendations**:
Temporary fixing recommendation: If the Gateway Actuator endpoint is not required, disable it using `management.endpoint.gateway.enabled: false`. If the actuator is needed, protect it with Spring Security. Refer to https://docs.spring.io/spring-boot/docs/current/reference/html/actuator.html#actuator.endpoints.security for more details. **General Fixing Recommendations**:
The official security version has been released. Please download and update it promptly. Download link: https://github.com/spring-cloud/spring-cloud-gateway
## Attacks via URLs
Run with Python3:
Example:
# The information provided on this website is for reference only.
[source-iocs-preserved url=https://docs.spring.io/spring-boot/docs/current/reference/html/actuator.html#actuator.endpoints.security。,https://user-images.githubusercontent.com/104476528/172762289-16b9604a-2f77-4aa9-bb45-5eb873715387.png]