CVE-2022-22947 PoC — VMware Spring Cloud Gateway 代码注入漏洞

Description

Spring Cloud Gateway Actuator API 远程命令执行 CVE-2022-22947

介绍

# Spring Cloud Gateway RCE Env   CVE-2022-22947

> CVE-2022-22947 was identified in the Spring Cloud Gateway Server jar.
> After the application is compiled you should be able to view the existing routes by visiting: http://127.0.0.1:9000/actuator/gateway/routes

### Compile

```
$ mvn package -DskipTests
```

### Run

```
$ java -jar target/spring-gateway-rce-0.0.1.jar
```

The application should run be running on port 9000.

文件快照

备注