CVE-2021-22051 Request injection in Spring Cloud Gateway
Attackers can force Spring Cloud Gateway to make unauthorized requests to downstream services, potentially accessing internal resources.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-22051?
CVE-2021-22051 is a medium-severity server-side request forgery vulnerability in Spring Cloud Gateway, published on 8 Nov 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.5+, 2.2.x users should upgrade to 2.2.10.RELEASE or newer.
Weakness: CWE-863
Which versions are affected by CVE-2021-22051?
4 open source packages ship an affected version, including org.springframework.cloud:spring-cloud-gateway. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.cloud:spring-cloud-gateway Maven | From 2.2.0 | 2.2.10.RELEASE0.5 |
org.springframework.cloud:spring-cloud-gateway Maven | From 2.2.0 | 2.2.10.RELEASE0.5 |
org.springframework.cloud:spring-cloud-gateway Maven | From 3.0.0 | 3.0.5 |
org.springframework.cloud:spring-cloud-gateway Maven | From 3.0.0 | 3.0.5 |
Products include Vmware Spring Cloud Gateway.
How do I fix CVE-2021-22051?
Upgrade org.springframework.cloud:spring-cloud-gateway to a fixed version for your release line: 2.2.10.RELEASE0.5 or 3.0.5.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2021-22051 being exploited?
There is no known exploitation of CVE-2021-22051 in the wild and no public exploit code.
Other vulnerabilities in Spring Cloud Gateway
Sources
Also known as GHSA-2r2v-q399-qq93.