r4y-br/cve-2022-22963Python automation script that reproduces CVE-2022-22963, a critical SpEL injection in Spring Cloud Function, enabling reverse shell in authorized lab environments.
Educational proof-of-concept automation for CVE-2022-22963, demonstrated in an authorized Hack The Box lab environment.
CVE-2022-22963 is a Spring Cloud Function vulnerability involving the
spring.cloud.function.routing-expression header.
Under vulnerable configurations, an attacker can abuse Spring Expression Language (SpEL) evaluation to invoke Java functionality through the function routing mechanism.
This repository contains a Python automation script used to reproduce the vulnerability in an authorized CTF/lab environment.
CVE ID: CVE-2022-22963 Affected component: Spring Cloud Function Affected versions: < 3.1.7, < 3.2.3 Fixed versions: 3.1.7, 3.2.3 Vulnerability class: Expression Language Injection (CWE-917) Attack vector: Network, unauthenticated (depends on deployment) Severity: Critical (CVSS 9.8 per NVD) References NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2022-22963 Spring official advisory: https://spring.io/security/cve-2022-22963 Fix commit / release notes: see Spring Cloud Function GitHub releases
Spring Cloud Function's routing feature allows a caller to select which function should handle a request via a header. Prior to the fix, the value of this header was passed into a SpEL evaluation context without restriction. Because SpEL supports invoking arbitrary Java classes and methods (e.g. T(java.lang.Runtime)), a crafted header value can result in OS command execution on the host running the vulnerable application.
Successful exploitation allows an unauthenticated attacker to execute arbitrary OS commands with the privileges of the application process, which can lead to full host compromise, lateral movement, or data exfiltration depending on environment configuration.
the code provided allows to inject a revertse shell on a vulnerable target
usage: exploit.py [-h] lhost lport url
This content is provided for authorized security research and education only (e.g. HTB lab environments). Do not use this information against systems you do not own or do not have explicit written permission to test.
