CVE-2022-22947: VMware Spring Cloud Gateway Code Injection Vulnerability

CVE-2022-22947 is a code injection vulnerability in VMware Spring Cloud Gateway. When the Gateway Actuator endpoint is enabled, exposed, and left unsecured, an attacker can inject and run code in the application. That puts the gateway and anything it fronts at risk of takeover, data access, or further lateral movement. Confirm exact product scope and fixed releases against the vendor advisory.

CISA notes that Spring Cloud Gateway applications are vulnerable under those actuator conditions and directs organizations to apply updates per vendor instructions. Ransomware use is not documented for this CVE.

How it works

This issue falls under CWE-94 (Improper Control of Generation of Code, or Code Injection). In short, the application can be tricked into treating attacker-supplied input as code that the runtime then executes.

In Spring Cloud Gateway, the risk appears when the Gateway Actuator endpoint is turned on, reachable from an untrusted network, and not properly secured. An attacker who can reach that endpoint may send crafted requests that cause the gateway process to evaluate and run injected code. The result is arbitrary code execution in the context of the gateway service. Exact request shape and preconditions must be taken from the vendor advisory; do not assume exploit details beyond the CWE-94 class and the actuator exposure condition described by CISA.

Am I affected? How to find it in your systems

Spring Cloud Gateway is commonly deployed as an API gateway or edge routing layer in Java/Spring-based microservices environments—on VMs, containers, Kubernetes, or platform-as-a-service stacks. Inventory any service that routes or aggregates traffic using Spring Cloud Gateway.

• Search configuration management, container images, and dependency manifests (for example Maven/Gradle coordinates and Spring Cloud Gateway artifacts) for Spring Cloud Gateway usage.
• Identify running instances via process lists, service catalogs, Kubernetes deployments/services, and API gateway inventories.
• Check whether the Gateway Actuator endpoint is enabled and whether it is reachable without authentication or network restriction. Review application properties, Spring Boot actuator configuration, and reverse-proxy or ingress rules that may expose management endpoints.
• Compare deployed versions and configurations to the fixed releases and guidance in the vendor advisory; do not rely on version guesses.
• For exploitation signs, review access logs and actuator-related HTTP traffic for unusual or unauthorized calls to management endpoints, unexpected process spawns or command execution from the gateway JVM, and anomalous outbound connections originating from gateway hosts. Correlate with host and container runtime telemetry. Absence of known signatures does not prove safety.

How to remediate

Patch first. Apply the updates specified by the vendor for VMware Spring Cloud Gateway, following the advisory’s instructions exactly. CISA’s required action is to apply updates per vendor instructions.

• After upgrading, verify that the Gateway Actuator endpoint is no longer exposed in an unsecured state—disable it if not required, or restrict it with strong authentication and network controls.
• Rebuild and redeploy images or packages so no old gateway binaries remain in registries or runtime environments.
• Re-scan dependencies and running workloads to confirm the vulnerable component is gone.
• Harden management interfaces generally: keep actuators and admin APIs off public networks, require authentication and authorization, and limit which actuator features are enabled.

If you can't patch immediately

Reduce exposure until you can apply the vendor update.

• Network segmentation: block untrusted access to the Gateway Actuator and other management ports; allow only jump hosts or management networks that are tightly controlled.
• Disable or tightly restrict the affected feature: turn off the Gateway Actuator endpoint if operationally possible, or bind it to localhost and protect it with authentication.
• Virtual patching / WAF: if you use a web application firewall or API gateway in front of the service, add rules that block or challenge suspicious requests to actuator and management paths. Treat this as temporary; confirm rule efficacy against the vendor’s description of the issue.
• Monitoring: alert on any access to actuator endpoints, unexpected code-loading or process activity on gateway hosts, and configuration drift that re-enables the endpoint.
• Least privilege: run the gateway process with minimal OS and cloud permissions so successful code injection has less blast radius.

If your data may have been exposed

Actively exploited code-injection flaws in internet-facing gateways can lead to full application compromise and follow-on data access. If you had an exposed, unsecured Gateway Actuator on a vulnerable build, assume possible compromise until you investigate: isolate affected hosts, preserve logs and memory/disk evidence, rotate credentials and secrets the gateway could reach, and review downstream systems the gateway authenticates to. Ransomware use is not documented for this CVE, but that does not rule out other malicious activity. You can run a free exposure scan of your email addresses against known breach data to see whether associated accounts appear in public breach corpora, then prioritize password resets and monitoring for those identities.