dbgee / CVE-2022-22947

Spring Cloud Gateway Actuator API 远程命令执行 CVE-2022-22947

Spring Cloud Gateway RCE Env CVE-2022-22947

CVE-2022-22947 was identified in the Spring Cloud Gateway Server jar. After the application is compiled you should be able to view the existing routes by visiting: http://127.0.0.1:9000/actuator/gateway/routes

Compile

$ mvn package -DskipTests

Run

$ java -jar target/spring-gateway-rce-0.0.1.jar

The application should run be running on port 9000.