PT-2022-2172 · Spring · Spring Cloud Gateway

Published 2022-03-01 · Updated 2023-02-22 · CVE-2022-22946

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Spring Cloud Gateway versions prior to 3.1.1+

Description The issue is related to the implementation of the TrustManager technology for authentication in the Spring Cloud Gateway library, which is used for creating API gateways. It is associated with errors in the certificate authentication confirmation procedure. Exploitation of this issue may allow an attacker to connect to remote services. When HTTP2 is enabled and no key store or trusted certificates are set in applications using Spring Cloud Gateway, an insecure TrustManager is used, allowing the gateway to connect to remote services with invalid or custom certificates.

Recommendations For Spring Cloud Gateway versions prior to 3.1.1+, update to version 3.1.1 or later to resolve the issue. As a temporary workaround, consider disabling HTTP2 or configuring a key store with trusted certificates to prevent the use of an insecure TrustManager. Restrict access to remote services until the issue is resolved.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-254

CWE-295

Related Identifiers

BDU:2022-02183

CVE-2022-22946

Affected Products

Spring Cloud Gateway

References · 8

• https://tanzu.vmware.com/security/cve-2022-22946 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-22946 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22946 · Security Note
• https://oracle.com/security-alerts/cpujul2022.html · Patch
• https://bdu.fstec.ru/vul/2022-02183 · Security Note
• https://t.me/cvenotify/27766 · Telegram Post
• https://t.me/cibsecurity/38436 · Telegram Post
• https://vuldb.com/ru/?id.194222 · Note