CVE-2022-22947

CVE-2022-22947 exploits the Spring Cloud Gateway Actuator endpoint's route creation functionality, which allows dynamic addition and modification of gateway routes through HTTP API calls. When an attacker sends a specially crafted request to create or modify a route, they can include a filter definition containing a Spring Expression Language (SpEL) expression. The Gateway processes this expression without adequate validation or sandboxing, causing it to be evaluated by the SpEL evaluation engine. SpEL is a powerful expression language that supports method invocation, object construction, and access to the Java runtime environment. By crafting a SpEL expression that calls Runtime.exec() or similar methods, an attacker can execute arbitrary operating system commands on the server. The attack flow typically involves: (1) sending a POST request to the Actuator routes endpoint to create a malicious route with a SpEL payload in a filter, (2) sending a POST request to the refresh endpoint to apply the route, and (3) sending a GET request to the new route to trigger the SpEL evaluation. The Actuator endpoint is disabled by default in newer Spring Boot versions, but many deployments enable it for monitoring purposes and fail to secure it properly.