## https://sploitus.com/exploit?id=5423CECE-181F-5F68-AC03-189C2DB2328A
# CVE-2022-22963
Educational proof-of-concept automation for CVE-2022-22963, demonstrated in an authorized Hack The Box lab environment.
## Overview
CVE-2022-22963 is a Spring Cloud Function vulnerability involving the
`spring.cloud.function.routing-expression` header.
Under vulnerable configurations, an attacker can abuse Spring Expression
Language (SpEL) evaluation to invoke Java functionality through the
function routing mechanism.
This repository contains a Python automation script used to reproduce
the vulnerability in an authorized CTF/lab environment.
CVE ID: CVE-2022-22963
Affected component: Spring Cloud Function
Affected versions: < 3.1.7, < 3.2.3
Fixed versions: 3.1.7, 3.2.3
Vulnerability class: Expression Language Injection (CWE-917)
Attack vector: Network, unauthenticated (depends on deployment)
Severity: Critical (CVSS 9.8 per NVD)
References
NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2022-22963
Spring official advisory: https://spring.io/security/cve-2022-22963
Fix commit / release notes: see Spring Cloud Function GitHub releases
## Root Cause
Spring Cloud Function's routing feature allows a caller to select which function should handle a request via a header. Prior to the fix, the value of this header was passed into a SpEL evaluation context without restriction. Because SpEL supports invoking arbitrary Java classes and methods (e.g. T(java.lang.Runtime)), a crafted header value can result in OS command execution on the host running the vulnerable application.
## Impact
Successful exploitation allows an unauthenticated attacker to execute arbitrary OS commands with the privileges of the application process, which can lead to full host compromise, lateral movement, or data exfiltration depending on environment configuration.
## Working Proof Of Concept
the code provided allows to inject a revertse shell on a vulnerable target
```usage: exploit.py [-h] lhost lport url```
## Disclaimer
This content is provided for authorized security research and education only (e.g. HTB lab environments). Do not use this information against systems you do not own or do not have explicit written permission to test.