# N/A
## 漏洞概述
Spring Cloud Gateway在某些版本中存在代码注入漏洞，允许远程攻击者通过恶意请求在远程主机上执行任意代码。
## 影响版本
- 在3.1.1和3.0.7之前的版本
## 细节
当Gateway Actuator端点启用、暴露且未受保护时，该漏洞使应用容易受到代码注入攻击。攻击者可以通过制造恶意请求，利用此漏洞执行任意远程代码。
## 影响
远程攻击者能够通过恶意请求在未打补丁的系统上执行任意代码，从而造成严重的安全威胁。
| # | POC 描述 | 源链接 | 神龙链接 |
|---|---|---|---|
| 1 | CVE-2022-22947 | https://github.com/lucksec/Spring-Cloud-Gateway-CVE-2022-22947 | POC详情 |
| 2 | poc for cve-2022-22947 | https://github.com/scopion/cve-2022-22947 | POC详情 |
| 3 | Spring cloud gateway code injection : CVE-2022-22947 | https://github.com/Vulnmachines/spring-cve-2022-22947 | POC详情 |
| 4 | Spring Cloud Gateway 远程代码执行漏洞Exp Spring_Cloud_Gateway_RCE_Exp-CVE-2022-22947 | https://github.com/Axx8/CVE-2022-22947_Rce_Exp | POC详情 |
| 5 | Spring Cloud Gateway < 3.0.7 & < 3.1.1 Code Injection (RCE) | https://github.com/crowsec-edtech/CVE-2022-22947 | POC详情 |
| 6 | SpringCloudGatewayRCE - CVE-2022-22947 / Code By:Tas9er | https://github.com/Tas9er/SpringCloudGatewayRCE | POC详情 |
| 7 | None | https://github.com/Greetdawn/CVE-2022-22947 | POC详情 |
| 8 | Spring Cloud Gateway远程代码执行漏洞 | https://github.com/Summer177/Spring-Cloud-Gateway-CVE-2022-22947 | POC详情 |
| 9 | Exp | https://github.com/BerMalBerIst/CVE-2022-22947 | POC详情 |
| 10 | CVE-2021-42013批量 | https://github.com/tangxiaofeng7/CVE-2022-22947-Spring-Cloud-Gateway | POC详情 |
| 11 | cve-2022-22947 spring cloud gateway 批量扫描脚本 | https://github.com/dingxiao77/-cve-2022-22947- | POC详情 |
| 12 | 日常更新一些顺手写的gobypoc，包含高危害EXP | https://github.com/flying0er/CVE-2022-22947-goby | POC详情 |
| 13 | Spring Cloud Gateway Actuator API 远程命令执行 CVE-2022-22947 | https://github.com/dbgee/CVE-2022-22947 | POC详情 |
| 14 | Spring-Cloud-Gateway-CVE-2022-22947 | https://github.com/nu0l/cve-2022-22947 | POC详情 |
| 15 | CVE-2022-22947批量检测脚本，回显命令没进行正则，大佬们先用着，后续再更 | https://github.com/nanaao/CVE-2022-22947-POC | POC详情 |
| 16 | 批量url检测Spring-Cloud-Gateway-CVE-2022-22947 | https://github.com/hunzi0/CVE-2022-22947-Rce_POC | POC详情 |
| 17 | None | https://github.com/22ke/CVE-2022-22947 | POC详情 |
| 18 | Spring Cloud Gateway远程代码执行漏洞POC，基于命令执行的基础上，增加了反弹shell操作 | https://github.com/M0ge/CVE-2022-22947-Spring-Cloud-Gateway-SpelRCE | POC详情 |
| 19 | Spring Cloud Gateway Actuator API SpEL表达式注入命令执行（CVE-2022-22947）批量检测工具 | https://github.com/YutuSec/SpEL | POC详情 |
| 20 | SpringCloudGatewayRCE / Code By:Jun_sheng | https://github.com/Jun-5heng/CVE-2022-22947 | POC详情 |
| 21 | None | https://github.com/darkb1rd/cve-2022-22947 | POC详情 |
| 22 | Spring Cloud Gateway Actuator API SpEL Code Injection (CVE-2022-22947) | https://github.com/mrknow001/CVE-2022-22947 | POC详情 |
| 23 | CVE-2022-22947_EXP,CVE-2022-22947_RCE,CVE-2022-22947反弹shell,CVE-2022-22947 getshell | https://github.com/aodsec/CVE-2022-22947 | POC详情 |
| 24 | 调试代码包含断点信息,直接导入即可进行调试 | https://github.com/ba1ma0/Spring-Cloud-GateWay-CVE-2022-22947-demon-code | POC详情 |
| 25 | CVE-2022-22947 Exploit script | https://github.com/Arrnitage/CVE-2022-22947_exp | POC详情 |
| 26 | None | https://github.com/PaoPaoLong-lab/Spring-CVE-2022-22947- | POC详情 |
| 27 | cve-2022-22947-docker | https://github.com/hh-hunter/cve-2022-22947-docker | POC详情 |
| 28 | spring-cloud-gateway-rce CVE-2022-22947 | https://github.com/k3rwin/spring-cloud-gateway-rce | POC详情 |
| 29 | None | https://github.com/bysinks/CVE-2022-22947 | POC详情 |
| 30 | CVE-2022-22947_POC_EXP | https://github.com/Wrin9/CVE-2022-22947 | POC详情 |
| 31 | CVE-2022-22947 memshell | https://github.com/viemsr/spring_cloud_gateway_memshell | POC详情 |
| 32 | None | https://github.com/Enokiy/cve-2022-22947-spring-cloud-gateway | POC详情 |
| 33 | poc for CVE-2022-22947 | https://github.com/Nathaniel1025/CVE-2022-22947 | POC详情 |
| 34 | None | https://github.com/Vancomycin-g/CVE-2022-22947 | POC详情 |
| 35 | None | https://github.com/scopion/CVE-2022-22947-exp | POC详情 |
| 36 | Spring Cloud Gateway RCE - CVE-2022-22947 | https://github.com/sagaryadav8742/springcloudRCE | POC详情 |
| 37 | Spring Cloud Gateway Actuator API SpEL Code Injection. | https://github.com/fbion/CVE-2022-22947 | POC详情 |
| 38 | Spring-Cloud-Gateway-CVE-2022-22947 | https://github.com/talentsec/Spring-Cloud-Gateway-CVE-2022-22947 | POC详情 |
| 39 | CVE-2022-22947 reproduce | https://github.com/aesm1p/CVE-2022-22947-POC-Reproduce | POC详情 |
| 40 | Spring-Cloud-Spel-RCE | https://github.com/4nNns/CVE-2022-22947 | POC详情 |
| 41 | burp被动扫描插件，目前只有CVE-2022-22947 | https://github.com/expzhizhuo/Burp_VulPscan | POC详情 |
| 42 | Spring Cloud Gateway Actuator API SpEL Code Injection (CVE-2022-22947) | https://github.com/twseptian/cve-2022-22947 | POC详情 |
| 43 | CVE-2022-22947 注入Godzilla内存马 | https://github.com/whwlsfb/cve-2022-22947-godzilla-memshell | POC详情 |
| 44 | Spring Cloud Gateway Actuator API SpEL表达式注入命令执行（CVE-2022-22947） 注入哥斯拉内存马 | https://github.com/0730Nophone/CVE-2022-22947- | POC详情 |
| 45 | 一个可单独、批量验证的脚本，也可以反弹shell | https://github.com/anansec/CVE-2022-22947_EXP | POC详情 |
| 46 | None | https://github.com/Wrong-pixel/CVE-2022-22947-exp | POC详情 |
| 47 | 批量检测Spring Cloud Gateway 远程代码执行漏洞 Spring_Cloud_Gateway_RCE_POC-CVE-2022-22947 | https://github.com/stayfoolish777/CVE-2022-22947-POC | POC详情 |
| 48 | Nacos下Spring-Cloud-Gateway CVE-2022-22947利用环境 | https://github.com/B0rn2d/Spring-Cloud-Gateway-Nacos | POC详情 |
| 49 | None | https://github.com/kmahyyg/CVE-2022-22947 | POC详情 |
| 50 | None | https://github.com/LY613313/CVE-2022-22947 | POC详情 |
| 51 | None | https://github.com/SiJiDo/CVE-2022-22947 | POC详情 |
| 52 | None | https://github.com/qq87234770/CVE-2022-22947 | POC详情 |
| 53 | CVE-2022-22947注入哥斯拉内存马 | https://github.com/Zh0um1/CVE-2022-22947 | POC详情 |
| 54 | 121 | https://github.com/wallbreak1991/cve-2022-22947 | POC详情 |
| 55 | Spring Cloud Gateway Actuator API SpEL表达式注入命令执行Exp | https://github.com/Le1a/CVE-2022-22947 | POC详情 |
| 56 | CVE-2022-22947_EXP,CVE-2022-22947_RCE,CVE-2022-22947反弹shell,CVE-2022-22947 getshell | https://github.com/0x7eTeam/CVE-2022-22947 | POC详情 |
| 57 | 一款Spring综合漏洞的利用工具，工具目前支持Spring Cloud Gateway RCE(CVE-2022-22947)、Spring Framework RCE (CVE-2022-22965) 的检测以及利用 | https://github.com/charonlight/SpringExploitGUI | POC详情 |
| 58 | CVE-2022-22947 exploit script | https://github.com/cc3305/CVE-2022-22947 | POC详情 |
| 59 | None | https://github.com/Sumitpathania03/CVE-2022-22947 | POC详情 |
| 60 | Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22947.yaml | POC详情 |
| 61 | None | https://github.com/Threekiii/Awesome-POC/blob/master/%E5%BC%80%E5%8F%91%E6%A1%86%E6%9E%B6%E6%BC%8F%E6%B4%9E/Spring%20Cloud%20Gateway%20Actuator%20API%20SpEL%E8%A1%A8%E8%BE%BE%E5%BC%8F%E6%B3%A8%E5%85%A5%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%20CVE-2022-22947.md | POC详情 |
| 62 | https://github.com/vulhub/vulhub/blob/master/spring/CVE-2022-22947/README.md | POC详情 | |
| 63 | Spring Cloud Gateway 远程代码执行漏洞Exp Spring_Cloud_Gateway_RCE_Exp-CVE-2022-22947 | https://github.com/SecNN/CVE-2022-22947_Rce_Exp | POC详情 |
| 64 | burp被动扫描插件，目前只有CVE-2022-22947 | https://github.com/kkx600/Burp_VulPscan | POC详情 |
| 65 | 一个由AI生成的漏洞验证应用 | https://github.com/skysliently/CVE-2022-22947-pb-ai | POC详情 |
暂无评论