Spring Cloud Gateway 원격 코드 실행(RCE) 취약점 분석 및 대응 가이드 (CVE-2022-22947)

<!-- pom.xml -->
<dependency>
    <groupId>org.springframework.cloud</groupId>
    <artifactId>spring-cloud-starter-gateway</artifactId>
    <version>3.1.1</version>
</dependency>

// build.gradle
dependencies {
    implementation 'org.springframework.cloud:spring-cloud-starter-gateway:3.1.1'
}

# application.yml
management:
  endpoint:
    gateway:
      enabled: false # Gateway Actuator 엔드포인트 비활성화

// SecurityConfig.java
@Bean
public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
    http
        .authorizeExchange()
        .pathMatchers('/actuator/**').hasRole('ADMIN')
        .anyExchange().permitAll()
        .and().httpBasic();
    return http.build();
}

#!/bin/bash
# Gateway Actuator를 통한 라우트 생성 및 새로고침 시도 로그 검색
LOG_FILE='/var/log/nginx/access.log' # 실제 환경에 맞게 경로 수정

echo '[*] Scanning for potential CVE-2022-22947 exploitation attempts...'
grep -E 'POST .*/actuator/gateway/routes/' "$LOG_FILE" && echo '[!] Warning: Route creation attempts detected!'
grep -E 'POST .*/actuator/gateway/refresh' "$LOG_FILE" && echo '[!] Warning: Gateway refresh attempts detected!'