Spring Cloud Gateway remote command execution vulnerability

Threat Description

Applications that use Spring Cloud Gateway are vulnerable to code injection attacks when the Actuator endpoint is enabled, exposed, and unsecured. An attacker can craft a malicious request to execute arbitrary commands on the remote host.

Vulnerability details: https://avd.aliyun.com/detail?id=AVD-2022-22947

Recommendations

1. Upgrade to a secure version. Upgrade 3.1.x versions to 3.1.1 or later. Upgrade 3.0.x versions to 3.0.7 or later. Upgrade all other unsupported versions to the latest version.

2. Apply temporary mitigation measures (not recommended for long-term use):

• Disable the feature. If you do not need the Gateway Actuator feature, set management.endpoint.gateway.enabled to false and restart the service for the configuration to take effect.

• Enable protection using Spring Security. For more information, see https://docs.spring.io/spring-boot/docs/current/reference/html/actuator.html#actuator.endpoints.security.

If you encounter any difficulties during the remediation process or have other related questions, navigate to Security Control, click "Need Security Help", and contact a technical engineer for support.