Spring Cloud Gateway RCE Explained | Java Crack of the Week #4

In this fourth episode of Java Crack of the Week, we’re diving into the Spring Cloud Gateway RCE (CVE-2022-22947) — a critical vulnerability that allowed remote attackers to inject and execute code through exposed Actuator endpoints.
While it didn’t grab headlines like Spring4Shell, this security flaw was actively exploited in the wild, added to CISA’s Known Exploited Vulnerabilities list, and leveraged by botnets like Sysrv-K to hijack cloud servers for cryptomining.

In this video, you’ll learn:
* What Spring Cloud Gateway is and how it works
* How attackers exploited route filters using SpEL expressions
* Real-world impact: PoCs, federal alerts, and botnet activity
* Live exploit demo using Docker, SpEL, and curl
* How to secure Actuator and prevent this type of misconfiguration

If you’re using Spring Cloud in production, this is an episode you can’t afford to miss.

Like & Subscribe for weekly breakdowns of real Java vulnerabilities.

Chapters
00:00 – Intro & Why This Spring RCE Matters
00:28 – What Is Spring Cloud Gateway?
00:53 – How the Vulnerability Works (SpEL Injection Explained)
01:40 – Real-World Exploits & Impact (CISA, PoCs, Active Attacks)
02:05 – The Sysrv Botnet & Spring Exploitation
02:29 – What Attackers Could Do with RCE Access
02:46 – Preconditions for Exploiting CVE-2022-22947
03:29 – Attack Flow Visualized (Sequence Diagram)
04:39 – Vulnerable App Setup (Code Walkthrough)
05:50 – Exploiting Spring Cloud Gateway to Leak Secrets
06:57 – Developer Takeaways & Security Best Practices
08:00 – Outro & Final Thoughts

[iirekm]

Tyle że ja bym nie nazwał tego nawet atakiem, a lamerstwem adminów czy devopsów. Nigdy nie wystawia się endpointów /actuator/* na świat, one służą tylko na potrzeby programistów oraz infrastruktury (healthchecki, metryki). Samo to że ktoś ma dostęp do /actuator/* nawet jeśli akurat nie może zrobić RCE jest poważnym problemem bo pozwala np zrobić rekonesans przed innym atakiem.