Critical Code Injection Vulnerability in VMware Spring Cloud Gateway (CVE‑2022‑22947) Exposes Unsecured Actuator Endpoint
What It Is – The Spring Cloud Gateway component in VMware’s suite contains a code‑injection flaw (CVE‑2022‑22947). An attacker can supply malicious payloads to the Gateway Actuator endpoint when that endpoint is enabled, publicly reachable, and not protected by authentication.
Exploitability – Public proof‑of‑concept exploits exist; the vulnerability scores 9.8 (CVSS v3.1 – Critical). Successful exploitation yields remote code execution with the privileges of the gateway process.
Affected Products – VMware Spring Cloud Gateway (all versions where the Actuator endpoint can be enabled).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous configuration‑management monitoring – unmanaged management interfaces are a common audit finding across SOC 2, ISO 27001, and NIST CSF.
- Highlights the importance of access‑control evidence for critical service endpoints; without it, organizations cannot prove due‑diligence during third‑party assessments.
- Provides a concrete control‑gap that can be captured in a Trust Center to show auditors that remediation and ongoing verification are in place.
Recommended Actions
- Disable the Actuator endpoint in production or restrict it to trusted networks.
- Apply VMware’s security patch (or upgrade to a version where the issue is fixed).
- Implement continuous monitoring of exposed ports and management APIs; capture configuration drift as audit evidence.
- Document the remediation in your control‑mapping repository and map it to the “Secure Configuration Management” control objective.
Source: CISA KEV – CVE‑2022‑22947